What should I ask the mobile-network provider for?¶

Ask the mobile-network provider for records that answer the specific investigative question.

What this means¶

Possible requests may include subscriber details, account history, SIM and eSIM information, device identifiers, call records, SMS or MMS events, data sessions, cell-site data, number-porting records and SIM-replacement activity.

The exact request depends on what you are trying to prove.

Be clear about time zones.

Broad requests can create delay, unnecessary data and interpretation problems.

Also recognise the limits.

Subscriber data identifies the account holder, not automatically the user.

Call and message records may show technical events, not content.

Where records may be volatile, consider preservation through lawful local process.

The operational takeaway is: ask the network provider targeted questions about the subscription, SIM, device, communications and location-related records. Build the technical timeline first, then corroborate the human user.

What to check or do next¶

• If attribution is the issue, ask which SIM and device identifiers were associated with the number at the relevant time.
• If account takeover is suspected, ask about replacement SIMs, authentication, account contact and service interruption.
• If movement matters, identify the precise time period and relevant network events.
• Use all known identifiers, including the telephone number, IMSI, ICCID, IMEI and account details where available.
• Do not request everything by default.

Evidential limits¶

Cell-site data does not provide exact GPS location.