Each mobile phone is constantly connected to nearby base stations, even when calls or messages are not in use. Each base station has a unique identification number, the GPS location where it is located, as well as the defined range it covers - from a few hundred meters in the city, to about thirty kilometers in rural areas.
There are several ways to determine the location of a phone based on base stations. The first is to determine on the basis of the identification number of the base station where the phone was registered. It is the crudest method and gives the most imprecise data because it is only known that the device was located somewhere within the circle it covers. The accuracy itself depends on the density of base stations in that area. According to the second method, three or more base stations are observed, and the angle at which the signal arrives is measured. The position of the device is obtained by finding the place where the corners intersect. According to the third method, which is more complex than the previous two, the strength of the received signal, the time it takes for the signal to reach the station, and the difference in the time the signal arrives at different stations are taken into account. Based on this data, the distance from each station is mathematically calculated, and the intersection of the circles gives the location.
However, when it comes to retroactive forensics rather than tracking someone in real time, generally only the first method is used. The second and third methods require more precise data that operators do not routinely store in their logs, because otherwise the amount of stored data would be enormous.
That is why, in practice, two things are combined for retroactive forensics - the logs that are saved by the operator and the logic of movement. As the device moves, a series of base stations through which the phone has passed is recorded, and then forensic experts reconstruct the most likely route of movement. When the forensic analyst receives the data from the operator, it is in the form of tables with hundreds or thousands of rows - each row is a single event, with a time stamp and a base station identifier.
Analysts first map each base station on a map โ each station has known coordinates and a known coverage radius. Thus, the abstract identifier of the base station is converted into a concrete geographical zone. When these circles are lined up in chronological order, a corridor of movement begins to be outlined. Then it is necessary to interpret the transition from one base station to another. Based on the crossing speed and the number of stations, the analyst can conclude whether the device moved and how - whether on foot or by vehicle. Analysts who deal with this work know which stations cover which roads, and therefore the search is narrowed down. In the end, the obtained data is cross-referenced with recordings from cameras, toll booths or possibly the phone's GPS location. Then you get a complete picture.
In order to track the device via base stations, it is not necessary to use calls, messages or mobile data. And when it is in the "rest" state, the phone connects to the base stations around it by automatically registering to them - the only thing is that in the case of active use, that registration will be more frequent. The problem occurs if the device turns off or goes into airplane mode. Then only the last station before switching off is registered, as well as the first one after switching on again. Also, in the case of removing the SIM card or placing the device in the Faraday box, it will be impossible to connect the phone to the base station, and therefore the logs will not be able to reconstruct the movement.
Is it possible to manipulate base station logs? Practically not. The reason is the way and number of places where the logs are stored. Namely, when the phone is registered to the base station, its log will not be isolated because the logs are interwoven and are automatically replicated to multiple systems at the same time. It will be saved on the SIM card located in the device, the log file of the base station itself, as well as the logs of other phones that were on that base station at the same time. On the other hand, at the telecommunications operator itself, logs will be stored in several different places, including backup servers. Therefore, any manipulation would produce an inconsistency and become very easily noticeable in case of potential verification.
Location tracking via base stations is not as technologically precise as GPS location, but it is a reliable tool used as a basis for movement reconstruction.
