Expert System Digital

Telecommunications Evidence.
Analysed.

Arbiter transforms raw mobile call data records into clear, court-ready intelligence — entirely within your browser, with no data leaving your network.

Raw CDR data is not evidence. Analysis is.

When a communications service provider discloses call data records in response to a production order, what arrives is raw CSV — thousands of rows per number, across multiple operators, in inconsistent formats. A serious investigation routinely involves a dozen or more numbers, hundreds of thousands of records, and months of activity to account for.

Spreadsheet analysis is slow, error-prone, and produces no visualisations. Key evidential patterns — a relay calling chain, a cluster of short missed calls, a period of unexplained communication silence — are invisible in tabular data. And when it comes to presenting findings in court, a spreadsheet is not enough.

Investigators need a tool that handles the data engineering automatically, surfaces patterns that matter, and produces exhibits that stand up to scrutiny.

Everything you need to analyse telecommunications data.

Over twenty analytical views covering call records, mobile data events, location, and device history — all in one self-contained tool.

Call Record Analysis
Call Data Timeline
Calls arranged chronologically in day-grouped cards, colour-coded by type, with incident date markers and filter chips.
Daily Activity Chart
Stacked bar chart by day with seven-day rolling average lines and incident markers revealing activity trends over time.
Pattern of Life
Seven-day by twenty-four-hour heatmap of call activity — the behavioural fingerprint of a number.
Duration Distribution
Histogram across ten duration buckets from missed calls to thirty-minute conversations, with mean and median statistics.
Concurrent Activity Timeline
Swimlane chart with one row per monitored number showing daily call volume across the full investigation period.
Contact Intelligence
Signal Calls
Clusters of short-duration calls within a configurable time window — surfaces missed-call signalling patterns with an incidents-only filter.
Dark Periods
Gaps in communication per number, highlighted against incident dates. Unexplained periods of silence are evidentially significant.
Call Chain
Relay pattern detection: A calls B within minutes of B calling C, identifying potential intermediaries in a network.
Contact Matrix
n×n heatmap of shared external contacts between monitored numbers — association strength at a glance.
Network Graph
Force-directed contact network with node size proportional to call volume and edge weight reflecting contact frequency.
Location & Movement
Cell Map
Interactive Leaflet map of cell towers from MDE records, with movement tracks and directional arrows showing how a device moved.
Animated Map
Event-by-event playback of device movement with play/pause, speed controls, and a scrub slider. Multiple basemap options.
Co-location Events
Identifies occasions where two or more monitored devices registered to the same cell tower within a configurable time window.
Overnight Location
Aggregates MDE activity between 01:00 and 05:00 by tower — the most likely candidates for a subscriber's home area.
Device & SIM Analysis
IMEI Cross-Reference
Scans the full MDE dataset for handsets used by more than one monitored number — a single device across multiple SIMs is significant evidential material.
IMEI/SIM Timeline
Gantt chart of device and SIM changes over time, with incident overlays allowing correlation between handset changes and operational events.

From production order to court exhibit in three steps.

Arbiter is designed to fit into the existing CDR workflow — no new infrastructure, no training on complex tools, no data sent to a third party.

Step 01
Receive the data
CDR and MDE files arrive from the communications service provider as CSV in response to a production order. Drop them into the input folder — Arbiter handles O2, EE, and Vodafone formats including their metadata headers and varied column structures.
Step 02
Build the database
Run a single Python command. Arbiter parses all CSV files, normalises phone numbers across operators, resolves subscriber attribution, and produces a single self-contained HTML file with the full SQLite database embedded.
Step 03
Analyse in the browser
Open the HTML file in any modern browser. No installation, no server, no internet connection required. The full analysis environment — all views, queries, and exports — is available immediately and works entirely offline.

Court-ready output in three formats.

Every analysis view can be printed or saved as PDF. Raw data and contact networks can be exported for use in specialist analysis tools. All exports are watermarked with the licence holder's name and organisation.

📄
Formatted HTML Table
A printable report with call type colour coding, monospace phone numbers, subscriber name resolution, and a generation timestamp. Print to PDF directly from the browser for disclosure or exhibit use.
CSV Export
Query results as a standard comma-separated values file, compatible with Excel, LibreOffice, R, and Python. All values are quoted and escaped. Column names match the database schema.
📤
GraphML for i2 / Gephi
Directed graph export of the contact network compatible with IBM i2 Analyst's Notebook, Gephi, and Maltego. Edges carry call count, voice count, SMS count, and direction attributes.

Built for investigators, analysts, and legal professionals.

Police & Law Enforcement
Arbiter was developed in direct support of a major police operation. It is designed around the workflow of investigators who receive CDR data from multiple operators across an extended period and need to surface evidential patterns quickly.
Forensic Experts & Telecoms Analysts
The SQL query interface provides direct access to the underlying database for analysts who need to go beyond preset queries. Custom queries feed directly into all visualisation and export functions.
Legal Professionals
All views include a generation timestamp and record count. The formatted export and court-ready table output are designed with disclosure and presentation in proceedings in mind.

No server. No cloud. No installation.

Arbiter is architecturally simple by design — investigation data must never leave the analyst's machine.

No installation required — runs in any modern browser (Chrome, Firefox, Edge, Safari)
No server, no cloud — investigation data never leaves the analyst's machine
Fully offline — the tool operates entirely without an internet connection after the file is generated
Single portable file — SQLite database embedded in a self-contained HTML file
Scale-tested — used with datasets of 170,000+ call records and 109,000+ data events across 27 numbers
Multi-operator — parses CDR and MDE files from O2, EE, and Vodafone in standard production-order formats
Encrypted database — the embedded SQLite database is XOR-encrypted with a unique key at build time; the raw payload cannot be opened without the paired file
Tamper detection — a SHA-256 hash of the database is verified on every load; the tool refuses to open if the file has been modified
Licence tracking — each distributed copy carries a unique licence ID and canary record; all exports are watermarked with the recipient's name and organisation

Request a Demonstration

To arrange a demonstration of Arbiter with a sample dataset, or to discuss deployment for your unit or organisation, contact Expert System Digital.