The language of a criminal case

How scattered evidence becomes an account of what happened — and holds up when someone tests it.

Digital evidence

Information stored or transmitted in binary form that a case may rely on: device extractions, carrier records, video, account data, vehicle logs. Its defining property is that it is always a copy, so what matters is whether that copy is complete, unaltered, and traceable to where it came from.

See alsoProvenance · Hash verification

Timeline

The ordered account of what happened in a case, with each event tied to when and where it occurred. Unlike a plain list, a timeline holds the relationships between events — which makes it the format investigators, attorneys, and juries all already think in.

See alsoChronology · Corroboration · Crimeline

Chronology

A list of events in time order. Useful, and not the same as a timeline: a chronology answers only what came first, while the questions that decide cases are relational — what was near what, what overlapped, and whether the distance between two points could be covered in the time available.

See alsoTimeline

Corroboration

Independent evidence pointing to the same conclusion. A single record is an assertion; two unrelated sources agreeing inside the same window is a pattern. Corroboration is what turns an approximate location record into something that carries weight — or exposes that it does not.

See alsoTimeline · Digital evidence

Provenance

The record of where a piece of evidence came from and what has happened to it since: the source file, the tool that produced it, and every transformation applied. Provenance is what lets one point on a map be traced back to one row in one file.

See alsoChain of custody · Digital evidence

Case theory

The account of events that the evidence is being organized to test. Stating it explicitly makes the gaps visible — and guards against the failure mode every side of a case shares, which is assembling evidence to fit a theory rather than to test it.

See alsoCorroboration · Exculpatory evidence

Pattern of life

The routine a subject's data reveals over time — where they sleep, work, and travel, and at what hours. Established across days or weeks, it makes departures from routine visible, which is often more probative than any single record on its own.

See alsoTimeline

Discovery

The pretrial exchange of evidence between the parties. With digital evidence the practical problem is volume: material that has technically been produced can still be effectively buried, so handing over records in a form the other side can actually open matters as much as producing them.

See alsoExculpatory evidence · Summary exhibit

What a case actually produces, what each record contains, and the gotcha each one carries onto the timeline.

Mobile device extraction

A forensic copy of a phone's data. Logical extractions pull what the operating system exposes; file system extractions reach application data and databases; physical extractions capture the storage at a lower level. What can be recovered — deleted content especially — depends heavily on which method was used.

See alsoUFDR · Magnet AXIOM

UFDR

Cellebrite's reader report container, produced by its extraction tools and openable without a Cellebrite license. It carries extracted records along with their data sources and horizontal accuracy values, which is why it preserves considerably more context than a spreadsheet exported from the same extraction.

See alsoMobile device extraction · Accuracy radius

Magnet AXIOM

A digital forensics platform used to acquire and analyze data from phones, computers, and cloud accounts. Its locations export lists recovered location artifacts with timestamps and coordinates, which is the form most directly useful to a case map.

See alsoMobile device extraction

Warrant return

The bundle a provider produces in response to a warrant — for a carrier, usually call records plus a cell site list, sometimes specialized location data and subscriber information. It is a set of files that must be joined, not a single table, and the tower list often covers only a subset of the sites the records reference.

See alsoCall detail record · Cell site list · Subpoena return

Subpoena return

Records produced by a third party under subpoena: financial transactions, rideshare trips, deliveries, utility or employment records. Most carry a timestamp and many carry an address, so they can sit on the same timeline as location evidence even though they are not location data.

See alsoWarrant return · Cloud account return

Cloud account return

Records produced by an online platform under legal process — account details, activity logs, messages, stored files, and sometimes location history. Formats differ by provider and change often, and how long a provider retains a given category is frequently shorter than people assume.

See alsoWarrant return

ALPRAutomated license plate recognition

A fixed or mobile camera that reads plates and records each read with a timestamp, the camera's location, and usually an image. A read places a specific vehicle at a known point at a known moment, which makes ALPR unusually precise next to most other location evidence.

See alsoCorroboration

Vehicle infotainment forensics

Recovery of data from a vehicle's infotainment and telematics modules — recorded locations, connected devices, call logs, door and ignition events. Vehicles frequently retain location history long after a phone has been wiped or discarded, which makes them an underused source.

See alsoGPS and telematics

GPS and telematics

Position data logged by a device with a satellite receiver: ankle monitors, fleet and asset trackers, vehicle systems, fitness apps, and cameras. Far more precise than cell records, though precision varies with sky view, and a recorded point is only as good as the clock that stamped it.

See alsoAccuracy radius · Clock drift

Surveillance and body-worn video

Footage from fixed cameras, body-worn cameras, and vehicle systems. Its value on a timeline depends on its clock, which is frequently wrong — cameras drift, get set to the wrong zone, or were never set at all. Establish the offset before sequencing footage against other sources.

See alsoClock drift

Drone flight log

Telemetry recorded by an unmanned aircraft — position, altitude, heading, and time, sometimes including the operator's controller location. Recovered from the aircraft, the controller, or the vendor's cloud account, depending on the platform.

CAD / RMSComputer-aided dispatch / records management system

The agency's own logs of calls for service, unit assignments, dispatch times, and incident reports. Often the most precisely timed record in a case, and easy to overlook because it lives inside the agency rather than arriving as a return.

KML / KMZKeyhole Markup Language

An XML format for geographic data, originally from Google Earth, and its compressed form. It is the common export currency between forensic and mapping tools — many products that cannot speak to each other directly can both read KML.

How separate sources become one sequence, and where that quietly goes wrong.

Time zone normalization

Converting every timestamp in a case to one documented clock. Sources arrive in different zones and some mix zones internally, so ordering across sources is unreliable until they are normalized. Because a timeline's value is its sequence, this step silently breaks more timelines than any other.

See alsoClock drift · Timeline

Clock drift

The gradual divergence of a device's clock from actual time. Cameras and recorders are the usual offenders, and the error is often minutes rather than seconds. Drift is corrected by establishing an offset against a known reference, not by assuming the recorded time is right.

See alsoTime zone normalization · Surveillance and body-worn video

Accuracy radius

The uncertainty attached to a reported coordinate, expressed as a distance around it. Also called horizontal accuracy. Mapping a coordinate without its radius is the most common way a location record is made to look more precise than it actually is.

See alsoGPS and telematics · Geotag

Geotag

Coordinates embedded in a file's metadata, most often in a photograph or video. Geotags are easy to strip and easy to alter, and can reflect where a file was edited rather than captured — so they corroborate other evidence rather than standing on their own.

See alsoAccuracy radius · Corroboration

Playback

Moving through a case in time rather than reading it as a list. Scrubbing and playing a timeline shows movement and convergence that a static exhibit can only describe, which is what makes a pattern legible to someone who did not work the case.

See alsoTimeline · Adaptive zoom

Lateration

Constraining a position using distance measurements from more than one reference point. Two timing advance bands recorded close together in time intersect over a much smaller area than either describes alone. It is the defensible way to tighten a distance estimate — narrowing the drawn band is not.

See alsoTA arc · Timing advance

One evidence source among many, and the one most often read as more precise than it is.

Call detail recordCDR

A carrier's usage record for a call, text, or data session: date, time, duration or byte counts, the numbers involved, and the cell site and sector serving the device when the event began. It is a billing artifact — location is a side effect of accounting, not the purpose of the record.

See alsoWarrant return · Cell sector · CSLI

Cell site

The physical location holding the equipment that transmits and receives cellular signal. Not a synonym for tower: sites also sit on rooftops, light poles, flagpoles, and steeples, and one structure can host several carriers. Small cells, distributed antenna systems, and cells-on-wheels are all cell sites with very different coverage.

See alsoCell sector · Cell site list

Cell sector

The portion of a cell site covering one direction, most commonly three sectors of roughly 120 degrees each. A sector is an antenna face, not a territory — devices do not reliably attach to the geographically nearest one, because network load, terrain, and maintenance all route traffic elsewhere.

See alsoAzimuth · Beamwidth · Cell site

Azimuth

The compass direction a sector antenna points, in degrees clockwise from north. The azimuth marks the center of the sector's coverage and bisects its beamwidth. A common plotting error treats it as an edge instead, which rotates every wedge on the map by half a beamwidth.

See alsoBeamwidth · Cell sector

Beamwidth

The angular width of a sector antenna's coverage, applied half clockwise and half counterclockwise from the azimuth. Reported beamwidth is measured at the half-power points, so it is not the edge of coverage — signal continues well past it, and a narrow figure understates the area a sector actually served.

See alsoAzimuth · Cell sector

Timing advanceTA

The correction a cell site sends a device instructing it to transmit earlier so its signal arrives in the correct time slot. Because the correction scales with propagation delay, the value corresponds to a distance band from the site. It measures time, not distance, and is reported as a band number rather than a range.

See alsoTA arc · Lateration

TA arc

The mapped form of a timing advance value: a curved band at a given distance from the site, clipped to the serving sector. The device could be anywhere along the arc. Multipath reflections add delay, so a device may be closer to the antenna than the value suggests — never farther.

See alsoTiming advance · Lateration

Cell site list

The carrier's inventory of its antennas: site coordinates, sector identity, azimuths, and beamwidths. Also called a tower list. It records versioned infrastructure state — sectors get re-pointed and decommissioned — so the list must be the one valid for the incident window, not the current one.

See alsoWarrant return · Cell sector

CSLICell site location information

The record generated whenever a device connects to a cell site, identifying the antenna and sector used. Its precision is a function of cell density rather than of the record itself — dense urban CSLI can be tight, rural CSLI can span miles. It accumulates without any user action.

See alsoCall detail record · Carpenter v. United States

Data session

A record of a data connection — start time, duration, bytes up and down — with no second party. Sessions fire without user action, so they leave location breadcrumbs the subscriber never initiated. A session can stay open while the device moves, so its cell site reflects one moment, not the whole span.

See alsoCall detail record

IMEI, IMSI, and MSISDN

Three identifiers that are routinely confused. IMEI identifies the handset hardware; IMSI identifies the network subscription held on the SIM; MSISDN is the dialable phone number. IMSI is not the SIM card's serial number. Numbers port between carriers and SIMs move between handsets, so choose the join key deliberately.

Tower dump

A production of every device that connected to a given cell site during a specified window, rather than records for one known target. Its Fourth Amendment status was expressly left open in Carpenter and is being actively litigated in the lower courts — treat the law here as unsettled.

See alsoCarpenter v. United States

The vocabulary that decides how evidence is offered, and by whom. None of it is legal advice.

Illustrative aid

Under Federal Rule of Evidence 107, effective December 2024, a presentation offered to help the jury understand evidence or argument rather than as evidence itself. It is not evidence, does not ordinarily go to the jury room, and must be entered into the record when practicable.

See alsoSummary exhibit · Animation vs. simulation

Summary exhibit

Under Federal Rule of Evidence 1006, a chart or summary admitted as evidence to prove the content of voluminous records that cannot conveniently be examined in court. The underlying records must be made available to the other parties, and those records must themselves be admissible.

See alsoIllustrative aid · Discovery

Authentication

Under Federal Rule of Evidence 901, the requirement that a proponent produce evidence sufficient to support a finding that an item is what they claim it is. The bar is low, and it is not a finding that the item is genuine. Rule 901(b)(9) covers output of a process shown to produce accurate results.

See alsoSelf-authentication · Laying a foundation

Self-authentication

Federal Rules of Evidence 902(13) and 902(14) let machine-generated records and hash-verified copies be authenticated by a qualified person's written certification instead of live testimony, provided advance notice is given. It resolves authenticity only — hearsay, relevance, and confrontation objections all remain available.

See alsoAuthentication · Hash verification

Chain of custody

The documented record of who held or controlled an item of evidence, when, and what they did with it. In most US courts, gaps go to the weight a jury gives the evidence rather than to its admissibility. Software can document custody events; the chain itself is a human process.

See alsoProvenance

Hash verification

Reducing a file to a fixed-length value that changes if any bit changes, then recomputing and comparing it later to confirm the data is unaltered. It verifies integrity, not truth or authorship. SHA-256 is preferred for new work, though MD5 remains in use for integrity checking.

See alsoSelf-authentication · Digital evidence

Exculpatory evidence

Evidence favorable to the accused. Under Brady v. Maryland (1963) the prosecution must disclose it whether or not the defense asks, and the obligation continues throughout the case. It is a reason any tool that filters or excludes records should keep the excluded set recoverable.

See alsoDiscovery · Case theory

Daubert standard

From Daubert v. Merrell Dow Pharmaceuticals (1993): the trial judge screens expert testimony for reliability, weighing testability, peer review, error rate, standards, and general acceptance. Kumho Tire (1999) extended this to technical and specialized testimony, so cell site analysis does not escape it by being technical rather than scientific.

See alsoFrye standard

Frye standard

From Frye v. United States (1923): a novel technique is admissible only if it has gained general acceptance in its field. Narrower than Daubert and still followed in a minority of states. Which standard applies is a question of local law, and published lists of Frye states are frequently out of date.

See alsoDaubert standard

Carpenter v. United States

585 U.S. 296 (2018). Acquiring historical cell site location information from a carrier is a Fourth Amendment search, and the third-party doctrine does not apply. The Court called the decision narrow and expressly reserved real-time CSLI and tower dumps. It held that seven days is a search; it did not create a seven-day rule.

See alsoCSLI · Tower dump

Laying a foundation

The predicate testimony establishing that an exhibit meets the applicable evidentiary requirements before it is admitted. For a case timeline that means a witness who can say where the data came from, how it got into the software, what the software did with it, and why the display reflects the underlying records.

See alsoAuthentication · Provenance

Animation vs. simulation

An animation depicts a witness's testimony or already-admitted evidence, and is judged on whether it is a fair and accurate representation. A simulation applies principles and data to generate a conclusion about what happened, and faces expert-reliability screening. The distinction decides which standard an exhibit has to meet.

See alsoIllustrative aid · Daubert standard

Words that mean something specific inside the product.

Crimeline

Our name for the case timeline where everything lives together — extractions, video, plate hits, tower records, and the events an investigator adds — on one clock and one map, explored by moving through time and presented in court exactly as it was built.

See alsoTimeline · Event

Event

An entry someone adds to a case: a title, a time, usually a place, and any attached media, notes, or exhibit numbers. Events are the narrative layer over imported records — the part a person wrote rather than a machine produced. An event with no location still appears on the timeline.

See alsoCrimeline · Timeline

Path

One subject's track through a case: a single device, vehicle, or source of location data. A case can hold several paths at once, each with its own color, which is how two phones — or a phone and a vehicle — get compared on the same map and the same clock.

Case timeframe

The window of time a case view is filtered to. Narrowing it focuses the map and timeline on the hours that matter without discarding anything, and the source data's full bounds are preserved so the view can always be widened again.

Adaptive zoom

A playback option that adjusts the map's zoom as a subject moves, keeping the relevant area in frame through long or fast stretches instead of leaving the viewer to follow a dot across a static map.

See alsoPlayback