Cellebrite

CDR Template Editor

User Manual
May 2022 | Version 2.2.236.232
Legal notices
Copyright © 2022 Cellebrite DI Ltd. All rights reserved.

This document is delivered subject to the following conditions and restrictions:

This document contains proprietary information belonging to Cellebrite DI Ltd. Such
information is supplied solely for the purpose of assisting explicitly and properly authorized
users of CDR Template Editor.
No part of this content may be used for any other purpose, disclosed to any person or firm,
or reproduced by any means, electronic or mechanical, without the express prior written
permission of Cellebrite DI Ltd.
The text and graphics are for the purpose of illustration and reference only. The
specifications on which they are based are subject to change without notice.
Information in this document is subject to change without notice. Corporate and individual
names and data used in examples herein are fictitious unless otherwise noted.
 Contents

1. Welcome 5

1.1. How does it work? 5

2. Getting started 6

2.1. System requirements 7

2.2. Supported apps 8

2.3. Installing CDR Template Editor 9

3. Creating a template: Overview 10

3.1. Starting CDR Template Editor 11

3.2. Upload sample files 12

3.3. Select relevant tables 19

3.4. Separate Data Types 21

3.5. Map model fields 27

3.6. Secondary mapping: values 35

3.6.1. Call Log: Start Time 36

3.6.2. Call Log: Duration 38

3.6.3. Call Log: Direction 39

3.7. Virtual columns 41

3.7.1. Virtual column functions 46

3.8. Join tables 50

3.9. Test the template 52

3.10. When CSLI data is separate 55

4. Normalizing data for upload into Pathfinder Enterprise 56

3
 5. Troubleshooting 62

5.1. Known limitations 63

5.2. Unexpected format 64

5.3. Format unrecognized 64

Contents 4
 1. Welcome
CDR Template Editor powers investigations by enabling LEAs to create a library of templates
for standardizing the formatting of CDR data so it can be easily ingested into other
investigative tools.

Empower your agency to perform mobile and CDR corroboration on a single

platform.

CDR Template Editor is used to create and customize templates that automatically map CDR
data into Cellebrite solutions.

Eliminate redundant effort

Build a provider-specific template once using the CDR Template Editor. Automate the
ingestion of an unlimited number of files in an unlimited number of cases.

Empower fellow agents to verify location data without requiring technical

assistance.

Share templates created with the CDR Template Editor to increase competency and
proliferate access to technical know-how across the agency.

1.1. How does it work?

Use CDR Template Editor to create a template that can automatically reformat CDR data
received from the carrier (service provider). The template is created by mapping the data fields
for a specific sample CDR file. Wherever possible, the Editor offers ways to reduce effort and
simplify the process. For example, when the system recognizes that the sample file matches
other existing templates in the library, it offers to customize an existing, closely-matching
template. This way, you do not need to start from scratch every time.

The library of CDR templates is used to enhance case evidence in Cellebrite solutions. CDR
data is ingested using a semi-automated process and the end result is that investigators can
visualize location data as recorded directly by the service provider at minimal effort.

5
 2. Getting started
This section includes the following:

2.1. System requirements 7

2.2. Supported apps 8

2.3. Installing CDR Template Editor 9

6
 2.1. System requirements
CDR Template Editor is a single-user desktop application to be installed on a computer that
meets the following system requirements.

Recommended Intel i5 – 4 cores

Processor

Minimum Intel i3 – 2 cores

Windows 10 64 bit
Recommended
Operating Windows Server 2019 64 bit
system Windows 7 64 bit
Minimum
Windows Server 2016 64 bit

Recommended 4 GB
Memory (RAM)
Minimum 4 GB

Recommended 50 GB of free space

Space
requirements
Minimum 10 GB of free space

.NET
Microsoft .NET Framework 4.5.2 is a prerequisite
Framework

Contents 7
 2.2. Supported apps
The following Cellebrite solutions currently support auto-mapping of CDR files using
templates created by CDR Template Editor:

Cellebrite Pathfinder Desktop v8.1 or higher.

Use this tool to create templates for use in Pathfinder Desktop. Upload the XML template
into Pathfinder Desktop to enable Pathfinder Desktop to automatically normalize
compatible CDR files.

Cellebrite Pathfinder Enterprise v7.8 or higher.

Use this tool to normalize CDR files from a wide range of providers. Export the normalized
data in .xlsx format and upload the .xlsx file into the relevant case in Pathfinder Enterprise.
See: Normalizing data for upload into Pathfinder Enterprise (on page 56)

8
 2.3. Installing CDR Template Editor
To install the CDR Template Editor application:
1. Download the application ZIP file from MyCellebrite and extract all files.
2. Run the .exe file. The installation wizard appears.

3. Follow the installation wizard.

Select the option to create a desktop shortcut.

Contents 9
3. Creating a template: Overview
Follow the step-by-step guide to create a new template.

3.1. Starting CDR Template Editor 11

3.2. Upload sample files 12

3.3. Select relevant tables 19

3.4. Separate Data Types 21

3.5. Map model fields 27

3.6. Secondary mapping: values 35

3.6.1. Call Log: Start Time 36

3.6.2. Call Log: Duration 38

3.6.3. Call Log: Direction 39

3.7. Virtual columns 41

3.7.1. Virtual column functions 46

3.8. Join tables 50

3.9. Test the template 52

3.10. When CSLI data is separate 55

10
 3.1. Starting CDR Template Editor

The default installation path is: All Programs > Cellebrite Mobile
Synchronization > CDR Template Editor

To start CDR Template Editor:

1. Double-click the desktop shortcut for CDR Template Editor.

2. The welcome page appears.

(Optional) Change the default destination folder. This is the storage folder where the library
of templates is stored.

The default save location is shared with other Cellebrite applications. If

you use the default save location, other Cellebrite apps, including
Cellebrite Analytics, automatically have access to the new template.

3. Click Next to continue. Proceed: Upload sample files (on the facing page).

Contents 11
 3.2. Upload sample files
CDR Template Editor is designed to create a template to match the file format and data
models of a particular service provider. It is important that the sample represent the format of
CDR files for the particular service provider.

If the data is received as separate files - usually a pair comprised of a CDR file and a CSLI file
(Cell-Site Location Information) - upload both files. See more details below.

The sample file should be an original, unaltered, CDR file as it was received
from the service provider.

Procedure

1. Click Browse to upload a sample CDR file.

Supported file formats: txt, csv, xls, xlsx

2. The file preview automatically appears. Scroll down and sideways to review the data.

12
 3. (Optional) Adjust the file preview window:

a. Adjust the file delimiter as necessary.

Available file delimiters: comma, semicolon, tab.

Contents 13
 b. Increase the number of rows presented in the preview.

4. Determine if a second sample file is required. This depends on whether the carrier stores
Cell Site Location Information (CSLI) in separate files.

If CSLI is stored inline in the CDR file, a second sample file is not necessary. Skip the
next step.
If CSLI data is stored in a separate file, a sample CSLI file must be uploaded to proceed.

5. If Cell-Site Location Information (CSLI) is stored in a separate file, upload a sample of it:

14
 a. Click Add cell tower locations file. Scroll down to the dedicated area, if necessary.

b. Click Browse and select a CSLI file to upload. Note the icon indicating cell-tower

locations: .

c. The preview automatically appears. Scroll down and sideways to review the data and
(optional) change the file delimiter.

Contents 15
 6. Select your preferred course of action:

Edit existing: Customize a copy of an existing template from your library. The template is
added to your library and does not overwrite another template.
Create new: Create a new template from scratch.

Editing an existing template reduces effort and minimizes duplication of

effort. We recommend that you do this whenever possible.

7. If you decide to edit an existing template, select a template from the library to customize it.

16
 a. Click suggest close matches to check if a relevant template already exists.

The system scans for relevant templates and suggests any, if available.

b.
The customized template is saved as a separate copy and does not
overwrite the original template.

8. If you decide to create a new template from scratch:

Contents 17
 Click Create new.

9. Click Next to continue. Proceed: Select relevant tables (on the next page).

18
 3.3. Select relevant tables
The editor automatically identifies the tables in the sample files. If a file contains multiple
tables or tabs, select those that are relevant. Only the tables selected at this step are mapped.
Conversely, those that are cleared are disregarded.

Troubleshooting

If any of the column headers contain numbers, the editor cannot identify the tables and you
cannot proceed. Edit the column headers in your sample file to omit any digits and start again.

Procedure

1. Select the relevant tables.

In the example above, the CSLI (Cell-Site Location Information) is

indicated by the icon .

2. (Optional) Manually identify the table type. This step is necessary for multi-tab
spreadsheets with separate tables for CSLI data. (By default, all tabs are identified as CDR
data and the CSLI (Cell Tower) table must be identified by the user.)

Contents 19
 3. (Optional) Rename the tables. This can be useful for future reference and collaboration.

4. Click Next to continue. Proceed: Separate Data Types (on the next page).

20
 3.4. Separate Data Types
Cellebrite data models require that data be mapped separately, by type: calls, SMS messages,
MMS messages, locations, etc.

If the data is not already separated, select Separate data types and follow the wizard to create
the rule for separating the data out by type.

Example

In the screenshot below, the data for all models is mixed in one table. The column Event Type
indicates when the data applies to calls, SMS, MMS or voicemail and can be used to create a
rule to separate the data by type.

Contents 21
 Procedure

22
 1. Click Separate data types to create rules for teasing apart the data by type.

2. Follow the wizard to create the separation rules:

Contents 23
 a. Select a column from the dropdown list. (The list shows all the column headers from the
carrier data file.)

b. After selecting a column, the system automatically returns all the distinct values found
in the sample file.

c. Match the values to the data type: calls, SMS, MMS. Each value can only be matched
once.

24
 d. (Optional) Account for missing values:

i. Custom: Add missing values manually. This is helpful when values that are in use by
the carrier happen not to appear in the sample data.

ii. Default mapping: (Optional) Specify a fallback for values that are not explicitly defined.

Contents 25
 Select None to avoid default mappings.

3. Click Save to proceed.

4. Proceed to map the data. See Map model fields (on the next page).

26
 3.5. Map model fields
Data is mapped separately for each of the data models: calls, SMS messages, MMS messages.

Procedure

1. Map call data:

a. Select defined Cellebrite model: Call Log

If a table contains data for several Cellebrite models, such as calls

and messages, map the same table multiple times - once per model,
as explained below.

b. Available Cellebrite model fields are listed. These are the desired ouput fields.

Contents 27
 c. Drag and drop the model fields to map them to the carrier data. (In other words, match
them up.)

Some fields require an additional mapping step. See Secondary

mapping: values (on page 35)

28
 d. All required fields must be mapped before the template can be tested and saved.
Required fields are marked by the red asterisk sign *.

e. Undo or redo mappings, as necessary. Hover over the field, click the menu button, and
select Edit or Remove.

2. Repeat the steps above for all other relevant models. For example, select SMS messages
and map the fields.

Contents 29
 a. If separate data types was selected, mappings for shared columns automatically apply to
all the models by default.

3. Redo mappings, as required. Hover over the mapping, click the menu button and select
Remove or Edit. (Edit is only relevant if secondary mappings are involved. See Secondary
mapping: values (on page 35)).

30
 The example above shows virtual columns, as indicated by the fill color.
See Virtual columns (on page 41).

4. If Cell Site Location Information (CSLI) is on a separate file, select Join tables. See Join
tables (on page 50).

5. Preview the proposed mapping results before testing and saving the template. Select any
row to preview the mapped result in the right pane.

Contents 31
 6. Export your normalized results to verify the template’s output.

32
 a. Click Export normalized CDR to parse the sample data.

b. Select a name, location, and format for your output file: Excel (.xlsx), csv or JSON.

c. Open the file to review your mapping results. The exported file represents the output
data that the proposed template would produce for the given sample CDR file.

7. When you are satisfied with the mapping results, click Save template to add the template to
your template library.

Contents 33
 The template is saved in XML format. Select a name and, if necessary, a location for your
template.

Best-practice recommendation: Name templates to clearly indicate the

service providers they are intended for.

8. Recommended: Test the template (on page 52).

The template is encrypted and cannot be viewed by any text reader.

34
 3.6. Secondary mapping: values
Some fields require an additional mapping step. In such cases, a dedicated wizard guides you
through the necessary steps.

3.6.1. Call Log: Start Time 36

3.6.2. Call Log: Duration 38

3.6.3. Call Log: Direction 39

Contents 35
 3.6.1. Call Log: Start Time

A dedicated wizard guides you through the necessary steps.

Procedure

1. Drag and drop the field Call Log: Start Time to the appropriate carrier column.

2. The wizard appears. The system automatically detects the date format and displays it.

3. (Optional) Change the template to override the automatic suggestion.

36
 If the sample file contains corrupt data, or the formatting is inconsistent, the editor may fail
to recognize the format correctly. Select a format manually or clean the data in the sample
file.

4. Save to continue.

Contents 37
 3.6.2. Call Log: Duration

A dedicated wizard guides you through the necessary steps.

Procedure

1. Drag and drop the field Call Log: Duration to the appropriate carrier column.

2. The wizard appears. The system automatically detects the correct format and displays it.

3. (Optional) Change the template to override the automatic suggestion. This is rarely
necessary.

4. Save to continue.

38
 3.6.3. Call Log: Direction

A dedicated wizard guides you through the necessary steps.

Procedure

1. Drag and drop the field Call Log: Direction to the appropriate carrier column.

2. The wizard appears. The right pane holds the carrier values that must be matched the
desired output.

3. Select one or more values from the dropdown list to match them.

Contents 39
 4. Save to continue.

40
 3.7. Virtual columns
When carrier data must be reformatted to match Cellebrite data models, virtual columns can
be used.

Virtual columns are used to perform calculations or other operations on carrier data, as
appropriate. When necessary, complex operations can be performed in sequence and
intermediate steps can be hidden from the output table.

Predefined options: by carrier

AT&T (Cell Location)

Contents 41
 Procedure

1. Click Add virtual columns.

2. The wizard opens. Select the operation to be performed and proceed as explained below.

42
 3. The wizard is similar regardless of the operation selected. For details, see Virtual column
functions (on page 46).

a. Apply function: select the function.

b. Source column: select the columns to be manipulated.
c. Function parameters: this field is specific to the operation. When it is not relevant it is
not shown.

d. Output column: Rename the virtual column and decide whether to show it in the table.

If the output must be mapped, select Show.

If the output is an intermediary step, it can be hidden or shown.
e. Sample output: Preview the result.

4. The virtual columns are added to the table. The fill color is different, indicating that the
columns are the output of virtual column operations.

Contents 43
 5. Deleting virtual columns:

44
 a. Delete the entire grouping of dependent virtual columns by clicking the X icon in the
table. A warning message appears. Confirm to proceed.

b. Delete virtual columns selectively by clicking the edit icon. The wizard appears. X out one
column at a time, starting with the last one.

6. Proceed to map the data. See Map model fields (on page 27).

Contents 45
 3.7.1. Virtual column functions

Supported operations

1. Merge: Merge two input columns into a single column. The default delimiter is a space.

Usage example: Some providers give date and time at two separate columns. Use the
merge function to merge date and time data into a single virtual column.

2. String trim: Eliminate characters from the string wherever they appear. (This function is not
limited to leading and trailing characters.)

3. Substring: Extract characters from a string, based on their index position.

46
 Function parameters: select the characters based on their index position, starting with
index = 0.

4. String replace: Replace characters in the strings.

5. String length: Calculates the length of a string. Can be used to create a function that
depends on the index location of characters.

Function parameters: not relevant.

Contents 47
 6. String Split: Split a string based on a predefined delimiter.

Function parameters: select the delimiter that is used to split the string. (The system
indicates the number of times it appears in the string.)

In the example below, a string is split into separate data and time columns.

7. RegEx: See Microsoft documentation for details.

8. AT&T Location: This function is tailored specifically for the column: Cell Location in AT&T
CDR files. It performs multiple operations in succession.

48
 9. Conditional: Compare the phone number entered in the Define Template tool (as part of
case creation in Pathfinder) to the number in the selected column.

Condition: Does a specific row in the selected column contain the owner's phone number?

Yes: Take the value in the parallel row in the second selected column and place it in the
virtual column.

No: Take the value in the parallel row in the third selected column and place it in the virtual
column.

Contents 49
 3.8. Join tables
If CSLI data is not stored inline, you must join the tables.

Tables can be joined at any point, either before mapping the data or after. Best practice
recommendation is to map the columns, preview the results, and then join the tables.

A simple wizard guides you in the process. Select from the predefined solution for a select
number of carriers (Verizon CDMA, Verizon LTE, Sprint CDMA), or create a custom rule.

Not sure if this step is necessary? Check if CDR and Cell Site Location
Information (CSLI) are stored in separate files or tables. If the answer is
yes, this step is required.

Procedure

1. Prerequisite: If Cell-Site Location Information is stored in a separate file, the sample

should have been uploaded. See step 5 in Upload sample files (on page 12).

2. Click Join tables.

3. A wizard opens. Select a predefined rule or create a custom rule.

50
 a. Custom: Select the first or last sector to define the join operation. Up to 3 columns can
be used to create the rule.

See Telus Canada example below.

b. Predefined rule: select from the options.

A limitation currently prevents mapping both the first and last sector, when
the join tables operation is in use.

Contents 51
 3.9. Test the template
After saving the template, test it with other data files and verify the results.

We recommend that you test the template with several different data files to assess the ability
of other Cellebrite applications to automatically identify and match the template to native CDR
carrier data. For example, testing the template in CDR Template Editor helps to validate the
ability of Cellebrite Analytics solution to automatically identify the correct CDR template when
new CDR data is uploaded.

Procedure

1. Open the CDR Template Editor or backtrack to return to the opening screen. Click Browse
to upload an appropriate CDR file.

2. Click Suggest close matches. The system should suggest the template you are attempting
to test as one of the options. Select it.

52
 3. Click Next to continue. Select the relevant tabs. Click Next to continue.

4. The data should be already mapped. This is because the system retrieves the mapping
saved in the template.

Contents 53
 5. Export your normalized results to verify the template’s output.

a. Click Export normalized CDR to parse the sample data.

b. Select a name, location, and format for your output file: Excel (.xlsx), csv or JSON.

6. Open the file to review your mapping results. The template and normalized CDR file are
ready for use.

54
 3.10. When CSLI data is separate
Some carriers keep Cell Site Location Information (CSLI) in separate files apart from CDR
data. If CSLI data is not stored inline, there are a few variations in the workflow, as detailed
below.

Distinct workflow steps for separate CSLI files:

1. Upload 2 sample files, one for the CDR data and the second with CSLI (cell-tower location)
data.
2. Use the operation Join tables to merge the data. Select from several predefined options or
create a custom rule. See Join tables (on page 50).

Otherwise, the workflow is similar, regardless of whether CSLI data is stored inline or not.

Predefined join options: by carrier

Verizon CDMA
Verizon LTE
Sprint CDMA

Other join options: custom

If a predefined option does not suit your requirements, use the custom option. Define an
operation involving up to 3 columns for joining CDR and CSLI tables.

Limitation

When CSLI data is not inline, only the first or last sector can be mapped, but not both.

When defining the join tables operation, select the first or last sector. Currently, this limitation
applies to both predefined join templates and the custom option.

Contents 55
4. Normalizing data for upload into Pathfinder
Enterprise
CDR Template Editor can be used to quickly normalize CDR data for upload into Pathfinder
Enterprise.

Procedure

1. Open the CDR Template Editor. Click Browse to upload the CDR file that is to be
normalized.

2. If Cell-Site Location Information (CSLI) is stored in a separate file, upload one sample
CSLI file.

Make sure that all relevant CSLI files are saved to the same directory folder as the sample
you selected. When normalizing the data, CDR Template Editor scans all the CSLI files
located in the folder.

56
a. Click Add cell tower locations file. Scroll down to the dedicated area, if necessary.

b. Click Browse and select a CSLI file to upload. Note the icon indicating cell-tower

locations: .

57
3. Click Suggest close matches. Assuming a template already exists, the system should
suggest it. Select it. Click Next to continue.

If no template is found, create a new one. See: Creating a template:

Overview (on page 10)

58
4. Select the relevant tables. Click Next to continue.

5. The system retrieves the mappings saved in the template. You can preview the proposed
mapping results before exporting the data. Select any row to preview the mapped result in
the right pane.

59
6. Click Export normalized CDR to parse the data.

If using a CSLI sample file, CDR Template Editor scans all the CSLI files
located in the same folder as the sample.

7. Select the .xlsx format. Select a name and location for your output file.

CDR files are imported into Pathfinder Enterprise in .xlsx format.

60
The normalized CDR file is ready to be uploaded into Pathfinder Enterprise. Pair it with the
Generic CDR Template (with timestamp offset) in Pathfinder Enterprise.

61
 5. Troubleshooting
5.1. Known limitations 63

5.2. Unexpected format 64

5.3. Format unrecognized 64

62
5.1. Known limitations
1. Column header names must be unique.

The column header names must be unique. If the same column name appears more than
once - even if the header index is different - the results may be unexpected.

CDR Template Editor and engine may not create a template or may read it incorrectly if the
same column name appears more than once.

2. Column headers must not contain any numbers.

If any of the column headers contain numbers, the editor cannot identify the tables. Edit the
column headers in your sample file to omit any digits and begin over.

3. Join tables limited to single sector.

When CSLI data is not inline, only the first or last sector can be mapped, but not both.

When defining the join tables operation, select the first or last sector. Currently, this
limitation applies to both predefined join templates and the custom option.

63
5.2. Unexpected format
If the sample file contains corrupt data, the preview in the right pane displays the invalid data
as unexpected format for the corrupt values. Select a different row to see the output for other
rows.

5.3. Format unrecognized

If the sample file contains corrupt data, or the formatting is inconsistent, the editor may fail to
recognize the format correctly. Select a format manually or clean the data in the sample file.

64
65