Every attorney handling a serious crash eventually asks the same question: what one record shows the driver was on the phone? The question is understandable, but it assumes one answer exists. In personal injury litigation and commercial vehicle crash litigation, phone evidence comes from different sources. Each has its own precision, its own blind spots, and its own way of being misread.
We recently ran a LinkedIn poll asking this question, and the four answer choices were deliberately built so that each is correct under some set of facts. This article explains when. The distinction matters because the opinion you can defend depends on the record you have. A connected voice call in a Call Detail Record (CDR) proves something very different from a data session in a billing statement, and both differ from a timestamped artifact recovered from the handset itself. In Texas, where Transportation Code § 545.4251 addresses electronic messaging while operating a motor vehicle, and where federal rules at 49 C.F.R. §§ 392.80 and 392.82 address texting and hand-held phone use by commercial drivers, the factual record is what makes those provisions matter in a real case. How those provisions apply to your case is a legal question for counsel and the court. This article addresses only the forensic side.
Option 1: Connected Voice Call
A connected voice call is often the cleanest carrier-side evidence when the question is whether the phone was engaged in a call at the time of the crash. A call that begins before impact and ends after it puts the line in use during the critical window. The carrier’s CDR fields for voice usually include the originating and terminating numbers, the start time, the duration, and the direction. Those fields are system generated, which makes them harder to attribute to user error than anything typed or recorded by hand.
Consider a tractor-trailer rear-ends stopped traffic on a Texas interstate. The crash is fixed at 3:42 p.m. by the ELD, the dash camera, and the 911 call. The driver’s CDR shows an outgoing call to a dispatcher at 3:38 p.m. with a duration of 6 minutes. That is direct evidence of a connected call spanning the crash. It is also a useful piece of corroborating evidence for a pattern of communication with dispatch.
What supports it
- CDR entries with call start time, duration, and direction
- Subscriber information tying the number to the driver or the employer
- Employer dispatch logs or the other party’s records, which can confirm the call from the other end
- Device call logs, which can confirm the same event independently
Limits and caveats
Here is the breakdown of what the record does and does not establish.
- Directly shows: A voice session was connected for a stated duration on a stated line.
- Likely suggests: The user may have been engaged in a conversation, especially if the other party confirms it.
- Cannot determine from the record alone: Whether the driver was holding the phone, using Bluetooth or a vehicle system, or whether someone else was using the device. A voice call is not proof of hand-held use. That distinction matters legally and factually, so counsel may want device or vehicle infotainment data to address it.
An incoming call entry is also not the same as an answered call. Ringing, missed, and voicemail routed calls can all appear in some logs. Duration and connection context are what separate them. Time zone and clock issues also matter. Confirm whether the timestamps are in UTC or local time before anyone compares them to a crash time.
Option 2: SMS/MMS Metadata at Critical Minutes
When this is true
Text logs are often the best available evidence when the theory is that the driver was sending or receiving traditional text messages near the time of impact. The carrier records typically show the timestamp of the transaction, the direction, and the sending and receiving numbers. Content is often not retained by the carrier, or is retained only briefly, so the metadata usually stands on its own.
Suppose a plaintiff driver is involved in an intersection collision with a delivery driver in a company vehicle. The plaintiff driver was alone in his vehivle. The carrier records show outgoing SMS transactions at 10:14:52 and 10:15:20, with the collision reported at 10:15:31. That timing is direct evidence that transactions occurred on the line seconds before the crash. Across several minutes, a pattern of communication can be even more telling than a single entry, because it shows whether the messages before the crash were part of a continuing exchange.
What supports it
- Carrier text logs showing timestamps and direction
- Device message databases, which may show whether a message was composed, sent, read, or deleted
- The other party’s records and the recipient’s device, which can corroborate timing
Limits and caveats
- Directly shows: A messaging transaction was processed by the network at a recorded time.
- May suggest: Active engagement with the device near that time, particularly when a sequence of outgoing messages appears.
- Cannot determine from the record alone: Who typed the message, whether it was dictated by voice, whether it was sent automatically, or how long composition took. An incoming message shows only that a message arrived. It does not show when or if it was read by the driver.
Modern messaging complicates this further. iMessage, WhatsApp, and similar app messages generally do not appear as SMS entries in a CDR. At the carrier level they may look like data usage, if they appear at all. Those messages usually have to be examined on the device or in cloud backups, and which of those sources is available varies by facts. Also remember that some carrier records report when a message was handled by the network, which may differ from when it was composed or sent by the user.
Option 3: On-Device App Activity Near Impact
When this is true
Device artifacts are often the most detailed source when the question is what the user was doing, not just whether a network transaction occurred. Handsets can record system generated information such as screen state, lock and unlock events, app usage, notification activity, and message database entries. Some of these artifacts are stamped to the second.
In a commercial vehicle case, imagine a forensic extraction of a driver’s phone shows the screen unlocked in the final minute before impact, a navigation app in the foreground, and a messaging app opened 20 seconds before the crash time. Carefully interpreted, that is far more specific than any CDR. It is also the type of evidence that may be reviewed from a Magnet AXIOM report or another extraction analysis tool report, whether generated in house or outsourced.
What supports it
- Forensic cell phone extraction, where obtainable, with parsed artifacts
- Application databases and usage records
- Screen and lock state entries as well as Bluetooth connections
- Backups, where available, which may hold data no longer on the handset
Limits and caveats
- Directly shows: Certain system or app artifacts with recorded timestamps, to the extent the extraction parsed and preserved them.
- May suggest: Interaction with the device, when several artifacts line up.
- Cannot determine from the record alone: Who was holding the device, whether the vehicle was moving at that instant, or the user’s intent. An artifact showing an app opened does not by itself prove the user was typing. Distinguish user generated data, such as a composed message, from system generated artifacts, such as a background refresh or an automatic notification.
Availability varies. Logical, file system, and physical extractions differ by device, operating system, and version, and modern encryption limits what a physical extraction can reach. Retention of usage artifacts can also be short, so preservation timing matters. Deleted data may still be recoverable, may appear only as carrier metadata, or may be gone. Also confirm the device is the right one. Dual phones, company phones with mobile device management, and shared devices can all break the link between the handset and the driver. Proper examination protocols and documentation of the extraction are what make the results defensible.
A data session is a caution here. Carrier data logs often show that the device had a session. They do not show which app was used or whether the screen was on. Background activity generates data too. Data logs can support a broader pattern of communication argument, but artifacts from a forensic phone examination hold the best likelihood of explaining the data activity.
Option 4: A Multi Source Timeline, Not One Record Type
When this is true
In many cases, the strongest position does not depend on any single record. A timeline that integrates carrier CDRs, device artifacts, ELD and hours of service data, telematics, dash camera footage, dispatch messages, and 911 records let the analyst show where sources agree, where they diverge, and what remains unknown. Each source checks the others. That is what corroborating evidence looks like in practice.
Take a fatigued driver case. Records of duty status show the driver was near the end of a long duty period. The CDR shows outgoing messages and a short call in the ten minutes before the crash. The device extraction shows screen activity in the last two minutes. The ECM records a hard braking event at a time that can be reconciled with the phone’s clock. None of these alone tells the whole story. Together, with clock offsets addressed, they support a much more defensible account of what the driver may have been doing.
What supports it
- Normalized timestamps across all sources, with time zone and clock drift documented
- A communication matrix showing all parties and channels
- Cross party comparison, such as the driver’s records against dispatch or the other party’s records
- Notes identifying which entries are system generated and which are user generated
Limits and caveats
- Directly shows: What each individual source records, laid side by side.
- May suggest: Sequences and patterns that no single source proves.
- Cannot determine from the timeline alone: Anything the underlying sources cannot show. A timeline built on weak inputs is still weak. It also only reflects the sources collected, so gaps in preservation or subpoena scope carry through.
If cell site records are included, treat the location information carefully. Tower and sector data is consistent with a handset being somewhere within a coverage area. It cannot establish exact position, route, lane, or speed. Coverage handoff, network load, and handset behavior all affect which site served a session.
Tips for Attorneys
- Involve a cell phone records expert early. Preservation letters, subpoena scope, and extraction decisions are all made before most cases reach expert disclosure deadlines. An early review helps you request the right fields, in the right window, from the right sources.
- Ask for CDRs, not just billing records. Billing statements and CDRs differ in precision and fields. Confirm exactly what the return contains.
- Send preservation requests promptly. Carrier retention periods differ by record type and carrier, and device artifacts can be overwritten. See our post on how long phone companies keep their records.
- Anticipate subpoena friction. For a practical look at common obstacles, review the four biggest hurdles when subpoenaing carrier cell phone records. Discuss with the court and opposing counsel how business records affidavits under Texas Rule of Evidence 902(10) and Texas Rule of Civil Procedure 205 for nonparty discovery may bear on your requests.
- Define the examination protocol before extraction. Address who performs it, which device, what data categories, and how the chain of custody is documented. If an outside vendor produced a Magnet AXIOM report, have it reviewed for what was and was not parsed.
- Identify every device and user. Ask about second phones, company phones, MDM, tablets, and vehicle systems, and consider passenger use before attributing activity to the driver.
- Align the clocks. Document time zones, UTC offsets, and any known drift between the phone, the ELD, and the carrier before comparing timestamps.
Conclusion
There is no single best record. A connected voice call is strong for showing a line was in use. Text logs can show messaging activity at critical minutes. Device artifacts can speak to interaction with the handset. A multi-source timeline is often the most defensible way to bring those pieces together. The best evidence is the one that answers the specific question in your case and whose limits are stated honestly.
The stakes are practical. Overclaiming from a data log or a tower record invites impeachment. Underusing the sources you have leaves the case thinner than it needs to be. Careful CDR analysis, done early, protects both.
Please feel free to contact me at ben@braveinvestigations.com or use the contact form on this website.
Brave Investigations is licensed by the Texas Department of Public Safety, license number A28412101.
This article is for general educational purposes and is not legal advice. Process questions belong with counsel and the court.
