The insight card
Busiest hour and day, the proportion of activity after dark, the probable home tower and the probable work tower, the most contacted number, and how many handsets this SIM has been seen in — written out as sentences, so an officer reads a conclusion before a chart.
Anomaly flags
Silence gaps of three days or more; a contact absent from the early record that becomes one of the most-called; repeated night presence at a tower that is not the home tower; days carrying many times the normal volume; a handset or SIM change under the same number.
Movement map with replay
Every tower the number touched, plotted, with the route drawn between them in chronological order — and a replay control for the whole period, a single week or a single day, at three speeds.
Flow timeline
Calendar first. A strip per year showing which months carry the activity, then a month grid shaded by intensity. Pick a day to open it; pick several and they stack side by side for comparison.
Events
The raw record, paginated: date and time, call or message, incoming or outgoing, the other party, duration, cell identifier and tower address with a map link. Star any row.
Devices and SIMs
Every handset the SIM has been in, resolved from the IMEI to a brand and model, with a handset-change timeline. The SIM table does the same for IMSI, resolving operator and circle.
Contact and tower networks
Contacts sized by volume and coloured by whether the relationship is mostly calls or mostly messages; towers sized by how often the phone was there. Click through to the events behind any node.
Night and odd hours
22:00 to 06:00 isolated — volume, who was contacted, at which hour and from which tower. In a great many cases this single screen is the case.
Azimuth mapping
Coverage drawn as a directional wedge from the operator’s own azimuth and beamwidth rather than as a circle, which overstates where the handset could have been by roughly a factor of three. Set by hand with compass shortcuts, or import a whole radio plan.
Tower dump
Choose a site on the map or from the list and a time window: every number in the case present there is returned, with the full event log. The tool for the hour around the offence at the scene.
Co-location and co-travel
Two numbers and a tolerance from five minutes to four hours. Every occasion they shared a tower, mapped — plus the contacts the two numbers have in common.
IPDR by application
Destination hosts resolved to the applications behind them, ranked by session count, by data volume and by hour, with category flags for payment, crypto, social and messaging.