The crash happened on a county road in the Eastern time zone on Tuesday, October 13, at 9:42 p.m. A witness called 911 a minute later. The criminal case and the civil case that follows both turn on one question: was the driver on his phone?
Three sets of call detail records (CDRs) come back. The driver’s phone is on Verizon. The phone he was calling is on AT&T. The witness is on T-Mobile.
The Verizon return shows an outgoing call from the driver’s phone at 9:41 p.m. on October 13, lasting 104 seconds. The AT&T return shows an incoming call from the driver’s number at 01:41 on October 14. The T-Mobile return shows the witness’s 911 call at 01:43 on 10/14/2026.
Paste the three files into one spreadsheet and sort by time. The driver’s call sits at 9:41 p.m. on Tuesday. The same call, seen from the other phone, sits four hours later on Wednesday. The 911 call that fixes the time of the crash also lands on Wednesday morning. Read quickly, the sheet says the driver hung up long before anyone called for help.
Nothing is wrong with any of the three records. The carriers keep time differently.
Why the same call has two times
Each carrier documents its own format, and the formats do not match.
- AT&T. The column definitions for AT&T’s Mobility Voice Report state that call times are stored and displayed in Coordinated Universal Time (UTC). The connection time is in a column named ConnDateTime, the two phones are Originating Number and Terminating Number, and the duration is in a column named ET, written as hours, minutes, and seconds.
- T-Mobile. T-Mobile’s guide to its call detail records says its systems natively use UTC. Date and time are in separate columns, the date as mm/dd/yyyy and the time on a 24-hour clock. The phones are in columns named Calling Number, Dialed Number, and Called Number.
- Verizon. Verizon’s explanation form for its voice over LTE call detail lists the start time of each call in local time, and again in a second column labeled GMT. It gives the duration in seconds.
On October 13, Eastern time is four hours behind UTC. So 9:41 p.m. in the Verizon file and 01:41 the next day in the AT&T file are the same minute.
The location columns differ too. AT&T writes the cell location in one field that combines the tower identifiers, the longitude and latitude, and the sector. T-Mobile spreads it across separate columns for site, sector, azimuth, latitude, longitude, and street address.
Carriers revise these layouts. The key or explanation form that arrives with a return is the authority for that return.
Where the merged spreadsheet goes wrong
Time. A spreadsheet sorts whatever is in the cell. It does not know that one file is in UTC and another is local. Daylight saving time adds a second problem. In 2026, it ends on November 1 at 2 a.m., and the Eastern offset goes from four hours to five. A formula that subtracts four hours from every UTC row is right for October and wrong for every row after the change.
Columns. The originating number in one file is the calling number in another, and one carrier lists both a dialed number and a called number. Line up the wrong pair and the sheet shows calls going to the wrong phone.
Duration. One file says 104. Another says 00:01:44. They are the same length, and a total across the merged column will not treat them that way.
Each fix is a manual step. Each manual step has to be explained later to a supervisor, to opposing counsel, or to a jury.
Convert once, and write it down
Before any analysis:
- Read the key that came with each return and note the time zone it states.
- Choose one time zone for the case, usually local time where the events happened.
- Convert each carrier’s times to that zone, using the offset in effect on each date.
- Keep the carrier’s original timestamp in its own column beside the converted one.
- Record what was converted and how, so the work can be checked and repeated.
Three files, one network
Once the times agree, the remaining work is getting three layouts into one place. This is the part SentVi takes over.
The Import Wizard reads Excel spreadsheets, text files, and Access and SQL Server tables and queries. You drag each carrier’s columns onto the entities and relationships they represent: this column is the phone that placed the call, this one is the phone that received it, this one is the date and time. You can assign a single value to every record in an import, such as the carrier’s name, so each call on the chart shows which return it came from. A preview shows the first 500 rows before the database is updated, and you can create a checkpoint that backs up the database before the import runs.
The mapping is saved as an import specification file. The next AT&T return, in this case or another one, uses the same specification. The file is portable, so a colleague on another machine can use it too.
With all three returns in one database, a phone number is one entity no matter which file it came from, as long as the number is written the same way in each. The driver’s phone and the phone he called are joined by a record from each carrier, at the same minute.
From there, you can view the same data as a link chart, a timeline, and a map. Temporal analysis filters the network to a time range, such as the ten minutes around the crash. Get Links Between Selected shows the phones related to the ones you select, through multiple levels.
On the timeline, the outgoing call at 9:41, the incoming call at 9:41, and the 911 call at 9:43 sit in one sequence. The call began at 9:41 and lasted 104 seconds. The crash was at 9:42.
If you are new to phone records, Call Detail Records 101 covers what they contain and how they are obtained.
Book a demo to see your own carrier returns on one timeline, or watch a call detail record analysis in SentVi below.
