DONYELL HOLLANDS PHONE

Sprint Call Detail Records — Donyell Holland / 423-508-7552

Document Type: Cellular Call Detail Records / Sprint Carrier Return
Carrier: Sprint Corporation
Associated Person: Donyell Holland
Phone Number / PTN: 423-508-7552
Sprint Case Number: 2020-153492
Related Investigation: Randall Leslie homicide investigation / CPD 20-052161
Carrier Production Date: August 10, 2020
File Name: email-6129837-2020-153492-9245629.xlsx
File Size: approximately 21 KB

Summary

This Excel spreadsheet is part of the Sprint cellular-record production for Donyell Holland.

The file is stored in the case materials under both “Holland, Donyell Phone Recs” and “Holland sprint”, and the accompanying transmission email expressly identifies the production as:

“Holland’s Sprint records 20-52161.”
Sprint transmitted the records to Investigator Corey Stokes on August 10, 2020, under Sprint case 2020-153492. The spreadsheet was one of nine attachments included in that carrier response.

The spreadsheet contains call and text-detail records for telephone number:

423-508-7552

The carrier table includes the following fields:

• Calling Number

• Called Number

• Dialed Digits

• Mobile Role

• Start Date

• End Date

• Duration in Seconds

• Call Type

• NEID

• First Cell

• Last Cell

The records include both voice activity and text-detail activity, along with network/cell identifiers where available.

The extracted records begin on May 1, 2020 and continue through at least June 1, 2020, covering the critical May 27–28 period surrounding Randall Leslie’s disappearance.

On May 27, 2020, the spreadsheet shows activity involving 423-508-7552 including:

• two routed voice calls involving 865-243-6245 at approximately 7:05 AM;

• an inbound text-detail entry involving 423-316-1978 at approximately 11:04 AM;

• another routed voice transaction involving 865-243-6245 at approximately 12:40 PM;

• and a routed voice call involving 423-227-8883 at approximately 10:20 PM.

The records continue into May 28, including activity involving 901-403-5855, 423-999-1123, and 423-834-1917.

What This Document Establishes

This spreadsheet directly establishes that:

• Sprint maintained call-detail records for 423-508-7552;

• the records were produced as part of Sprint case 2020-153492;

• CPD associated the carrier production with Donyell Holland;

• the records contain voice-call and text-detail transactions;

• the records include precise start and end timestamps;

• call duration is provided in seconds;

• Sprint records distinguish inbound, outbound, and routed calls;

• some transactions contain first-cell and last-cell identifiers;

• and the dataset covers the important May 27–28, 2020 investigative period.

The spreadsheet also shows numerous entries labeled “Routed_Call.”

That term should not automatically be interpreted as a completed person-to-person telephone conversation. It is Sprint’s carrier transaction classification and must be interpreted using the carrier documentation included elsewhere in the Sprint production.

Likewise, a zero-second Text Detail entry establishes a network-recorded text transaction, not the content of the message.

Why This Document Matters

This is potentially a major timeline and location record for Donyell Holland’s phone.

Unlike a witness recollection made months or years later, carrier records provide contemporaneous timestamps showing when the device generated or received telecommunications activity.

The spreadsheet should therefore be compared directly against:

• Holland’s statements to police;

• witness accounts describing where Holland was on May 27;

• the alleged shooting timeframe;

• the 6:35 PM shots-fired report near Arbor Place/Teakwood;

• Teakwood and Stockton timelines;

• surveillance/video evidence;

• vehicle movements;

• Brown’s separate TracFone records;

• Kiara Carson’s phone records;

• and Sprint cell-site documentation contained in the remainder of the carrier production.

The 1ST CELL and LAST CELL fields are especially important.

Some records contain actual cell identifiers—for example, the spreadsheet includes entries using cell IDs such as 23847, 12960, 32962, 13857, and 13960—while many other transactions contain zeroes.

Those numerical identifiers are not themselves geographic locations.

They need to be cross-referenced with Sprint’s separate tower/site records contained in the other spreadsheets or supporting files from the same nine-attachment production.

That means this particular spreadsheet appears to be the transaction side of the evidence, while another attachment may supply the tower/site definitions necessary to translate cell IDs into physical locations.

The accompanying Sprint email is important because it confirms that this spreadsheet did not appear independently in the police file. It was one of the files sent directly by Sprint to Stokes on August 10, 2020.

Catalog Category

Digital Evidence / Cell Phones → Sprint Carrier Records → Call Detail Records → Donyell Holland / 423-508-7552

Sprint Carrier Image Attachment — Donyell Holland Phone Records / File 9259622

Document Type: Sprint Carrier-Records Image Attachment
Carrier: Sprint Corporation
Associated Person: Donyell Holland
Sprint Case Number: 2020-153492
Related Investigation: Randall Leslie homicide investigation / CPD 20-052161
File Name: email-6129837-2020-153492-9259622.tif
File Type: TIFF Image
File Size: approximately 626 KB
Carrier Production Date: August 10, 2020
Related Phone Number: 423-508-7552 — based on the accompanying Holland Sprint production

Summary

This TIFF image is one of the original electronic attachments transmitted by Sprint Corporation to Chattanooga Police Investigator Corey Stokes in response to the Sprint records request associated with Sprint case 2020-153492.

The file is stored specifically within the case-file folders identified as “Holland, Donyell Phone Recs” and “Holland sprint.” Multiple copies of the same approximately 640,810-byte TIFF appear in those duplicate case-file locations.
The accompanying Sprint transmission email provides the provenance for this image.

Sprint transmitted its response to Stokes on August 10, 2020, under the subject “Sprint case 2020-153492.” Stokes later forwarded the carrier production internally and expressly labeled the material:

“Holland’s Sprint records 20-52161.”

The Sprint response contained nine attachments, and this TIFF — email-6129837-2020-153492-9259622.tif — appears as the first listed attachment, with a reported size of approximately 626 KB.

The remainder of that same carrier production includes spreadsheets and RTF files containing call-detail, cell-site, and other Sprint records.

One of those spreadsheets, email-6129837-2020-153492-9245629.xlsx, contains call-detail records for 423-508-7552, the phone number associated in the production with Holland.

Because this specific file is a TIFF image rather than a text-readable document, Dropbox’s content extraction did not return the writing contained inside the image. Therefore, the precise printed content of this particular attachment should remain marked VISUAL REVIEW REQUIRED until the image itself is read clearly.

What This Document Establishes

This document directly establishes that:

• Sprint created or transmitted a TIFF image identified as 9259622;

• the image was part of Sprint case 2020-153492;

• Sprint transmitted the package to Investigator Corey Stokes;

• Stokes associated that Sprint package with Donyell Holland and CPD case 20-052161;

• this TIFF was included as one of nine original carrier attachments;

• it is preserved within the Donyell Holland phone-record section of the police case file;

• and duplicate copies of the same-sized file exist in multiple duplicated versions of the Holland case materials.

The document does not yet establish, from readable content available here:

• whether the image is subscriber information;

• whether it identifies an account holder;

• whether it is a certification or records-custodian page;

• whether it identifies an IMEI/ESN;

• whether it contains tower information;

• whether it is a billing/account record;

• or whether it contains another category of Sprint data.

Those details should not be assigned until the TIFF itself is visually readable.

Why This Document Matters

This file matters primarily because of its carrier provenance.

It was not a later police-created spreadsheet or defense-generated analysis. It was part of the original electronic response Sprint sent to Stokes.

That makes it part of the underlying source material from which investigators obtained Holland’s cellular evidence.

The fact that it is the first attachment listed in Sprint’s nine-file production suggests that it may provide introductory, identifying, subscriber, account, certification, or other carrier-level information related to the production, but that is only a possibility and should not be stated as fact until the image is read.

It should be reviewed together with the other eight attachments from the same production:

1. email-6129837-2020-153492-9259622.tif

2. email-6129837-2020-153492-9259624.tif

3. email-6129837-2020-153492-9259765.rtf

4. email-6129837-2020-153492-9245629.xlsx

5. email-6129837-2020-153492-9259739.xlsx

6. email-6129837-2020-153492-9259750.rtf

7. email-6129837-2020-153492-9259727.xlsx

8. email-6129837-2020-153492-9259746.xlsx

9. email-6129837-2020-153492-9259752.rtf

Those nine files together appear to constitute the substantive Sprint carrier return associated with Holland’s phone investigation.

This TIFF should therefore not be discarded merely because the filename is meaningless. The automated Sprint filename preserves its position within the carrier response, and the accompanying email authenticates its source and relationship to the rest of Holland’s phone records.

Once the image itself is readable, its exact content should be added to this catalog entry.

Catalog Category

Digital Evidence / Cell Phones → Sprint Carrier Records → Original Carrier Attachments → Donyell Holland → Sprint Case 2020-153492 → File 9259622

Status: KEEP — VISUAL CONTENT REVIEW REQUIRED

Sprint Carrier Image Attachment — Donyell Holland Phone Records / File 9259624

Document Type: Sprint Carrier-Records Image Attachment
Carrier: Sprint Corporation
Associated Person: Donyell Holland
Sprint Case Number: 2020-153492
Related Investigation: Randall Leslie homicide investigation / CPD 20-052161
File Name: email-6129837-2020-153492-9259624.tif
File Type: TIFF Image
File Size: approximately 402 KB / 411,642 bytes
Carrier Production Date: August 10, 2020
Related Phone Records: Holland Sprint cellular-record production

Summary

This TIFF image is one of the original electronic records transmitted by Sprint Corporation to Chattanooga Police Investigator Corey Stokes as part of the Sprint response associated with Sprint case 2020-153492.

The file is preserved in multiple locations specifically identified as “Holland, Donyell Phone Recs” and “Holland sprint.” The located copies have the same filename and reported size of 411,642 bytes, supporting that they are duplicate copies of the same carrier attachment rather than separate records.
The accompanying Sprint transmission email establishes the provenance of this TIFF. Sprint sent its response to Stokes on August 10, 2020, and Stokes later described that carrier production internally as:

“Holland’s Sprint records 20-52161.”

The Sprint response contained nine attachments. This file, email-6129837-2020-153492-9259624.tif, was the second TIFF image attachment listed in that production, immediately following 9259622.tif.

The other attachments in the same production include multiple XLSX spreadsheets and RTF records containing Holland’s Sprint call-detail and related cellular information.

Unlike the spreadsheets, this particular attachment is a TIFF image. The available Dropbox indexing identifies the file and its provenance but does not provide readable extracted text from inside the image.

Accordingly, the precise printed information on this TIFF should not yet be characterized beyond what the carrier-production record establishes.

What This Document Establishes

This document directly establishes that:

• Sprint produced a TIFF image identified as file 9259624;

• the file was part of Sprint case 2020-153492;

• it was transmitted as part of the Sprint production sent to Investigator Corey Stokes;

• Stokes associated that production with Donyell Holland and CPD case 20-052161;

• it was one of the original nine carrier attachments;

• it was the second TIFF image listed in that production;

• and identical-sized copies of the file were preserved in multiple Holland phone-record folders.

The presently accessible information does not establish exactly what the TIFF image depicts or states.

Until the image is visually readable, it should not be labeled specifically as:

• subscriber information;

• billing information;

• tower information;

• account information;

• an IMEI/ESN record;

• a certification;

• a search result;

• or a location map.

Any one of those could be possible, but the available source does not establish which one.

Why This Document Matters

This file matters because it is part of the original Sprint carrier return, not a later police summary or defense-created analysis.

That gives it evidentiary provenance independent of later interpretations of Holland’s phone records.

The Sprint return should be treated as a package.

The nine attachments were:

1. email-6129837-2020-153492-9259622.tif

2. email-6129837-2020-153492-9259624.tif

3. email-6129837-2020-153492-9259765.rtf

4. email-6129837-2020-153492-9245629.xlsx

5. email-6129837-2020-153492-9259739.xlsx

6. email-6129837-2020-153492-9259750.rtf

7. email-6129837-2020-153492-9259727.xlsx

8. email-6129837-2020-153492-9259746.xlsx

9. email-6129837-2020-153492-9259752.rtf

The previously reviewed 9245629.xlsx contains call-detail records associated with Holland’s Sprint number 423-508-7552.

The remaining files may provide the supporting information needed to interpret those call records, including subscriber, network, tower, or technical data. Each attachment therefore needs to remain separate until its function is established.

This TIFF should not be discarded because of its generic automated filename. Its source is authenticated by the carrier transmission email, and its relationship to Holland’s Sprint production is clear even though its internal image text is not presently extractable.

Catalog Category

Digital Evidence / Cell Phones → Sprint Carrier Records → Original Carrier Attachments → Donyell Holland → Sprint Case 2020-153492 → File 9259624

Status: KEEP — VISUAL CONTENT REVIEW REQUIRED

Sprint LTE Data Session Records — Donyell Holland / 423-508-7552

Document Type: Cellular LTE Data Session / Packet Data Records
Carrier: Sprint Corporation
Associated Person: Donyell Holland
Phone Number / PTN: 423-508-7552
Sprint Case Number: 2020-153492
Related Investigation: Randall Leslie homicide investigation / CPD 20-052161
File Name: email-6129837-2020-153492-9259727.xlsx
File Size: approximately 20 KB / 20,621 bytes
Carrier Production Date: August 10, 2020
Dropbox Owner Shown: Mcintyre, Kevin [LEG]

Summary

This spreadsheet is a Sprint LTE packet-data record for telephone number 423-508-7552, part of the carrier production associated with Donyell Holland.

The first line of the spreadsheet identifies:

PTN: 4235087552

Unlike the previously reviewed 9245629.xlsx, which contains voice-call and text-detail transactions, this file records the phone's LTE data sessions.

The spreadsheet contains fields including:

• LTE IMSI

• Ratt Type

• Source IPv4

• Source IPv6

• MEID/ESN

• GMT

• Session Type

• Session ID

• Record Number

• Bytes Received

• Bytes Sent

• eNode

• TAC

The records identify the LTE IMSI as:

312530208594787

The MEID/ESN field contains:

3553701018428107

The network type shown is LTE.

The spreadsheet records individual data sessions using entries labeled:

Start → Interm → Stop

For example, a session begins on May 15, 2020 at 18:29:03, followed by a stop record at 18:29:55. Another session begins approximately five seconds later and generates hourly intermediate records.

Each session can include the amount of digital traffic transmitted in both directions through the phone:

• Bytes Received

• Bytes Sent

The records also contain Sprint network identifiers including eNode and TAC values.

Examples appearing in this spreadsheet include:

• eNode 361676

• eNode 365724

• TAC 30583

The device changes network/session information during the records. For example, the file shows one LTE session ending on May 16 at approximately 10:54:21, followed immediately by another session beginning at 10:54:22 with a different IPv6 address/session identifier while using eNode 365724.

What This Document Establishes

This spreadsheet directly establishes that Sprint maintained LTE network-session records for 423-508-7552.

It establishes that:

• PTN 423-508-7552 was generating LTE packet-data records;

• Sprint recorded an LTE IMSI of 312530208594787;

• Sprint's MEID/ESN field contains 3553701018428107;

• the records contain timestamps associated with LTE sessions;

• sessions are identified as Start, Intermediate, and Stop events;

• Sprint recorded data transferred to and from the handset;

• the records contain source IP information;

• the records contain specific Sprint eNode identifiers;

• the records contain a TAC network identifier;

• and these records were retained as part of Holland's Sprint phone-record production.

This is therefore technically different from the ordinary call-detail record.

The earlier CDR tells us about calls and text transactions.

This spreadsheet tells us about the handset's LTE data-network connections.

Important Limitation — Data Activity Is Not Necessarily Human Activity

A data-session record should not automatically be interpreted as Holland actively using the phone at that moment.

Smartphones routinely generate LTE traffic without anyone touching them.

Examples include:

• email synchronization;

• application notifications;

• cloud synchronization;

• operating-system services;

• messaging applications operating in the background;

• location-related services;

• and other automated network activity.

Therefore, an LTE record can establish that the device/network connection generated activity, but it does not by itself establish that Holland personally opened an application, typed something, or physically interacted with the handset.

That distinction is important.

Why This Document Matters

This spreadsheet could become particularly important for timeline and cellular-location analysis.

The ordinary CDR contains fields such as 1ST CELL and LAST CELL.

This separate LTE spreadsheet contains eNode and TAC information.

Those are different parts of Sprint's network records, and the remaining carrier attachments may contain the lookup tables or site information needed to determine what physical Sprint network locations correspond to those identifiers.

The key numbers should therefore be preserved exactly:

PTN: 423-508-7552
LTE IMSI: 312530208594787
MEID/ESN field: 3553701018428107
Example TAC: 30583
Example eNodes: 361676 and 365724.

The eNode numbers are not themselves geographic coordinates.

They must be matched against Sprint's network/site records before drawing a geographic conclusion.

If one of the other attachments identifies the physical address, latitude/longitude, azimuth, or sector information corresponding to these eNodes, then the LTE records could be placed onto the case timeline.

That would allow comparison against:

• the May 27 disappearance timeline;

• the approximately 6:35 PM shots-fired report;

• Teakwood;

• Stockton Drive;

• witness accounts of Holland's movements;

• Holland's statements;

• vehicle movements;

• Brown's phone activity;

• and other cellular records.

This document also gives us another potentially useful device-identification link.

Sprint is not simply identifying the telephone number. It records the same LTE subscriber identity and device field repeatedly across network sessions. That information can later be compared against:

• the phone physically seized from Holland;

• property records;

• extraction reports;

• search-warrant descriptions;

• SIM/device information;

• and the other Sprint returns.

Evidence Interpretation

The strongest use of this record is:

“Sprint's records show that the handset associated with PTN 423-508-7552 maintained LTE network sessions identified by specific IMSI, device, eNode, TAC, IP, and timestamp information.”

The record should not yet be characterized as proving that Holland was physically located at a particular address.

The geographic step requires the corresponding Sprint site/eNode reference data.

Catalog Category

Digital Evidence / Cell Phones → Sprint Carrier Records → LTE / Packet Data Sessions → Donyell Holland / 423-508-7552 → Sprint Case 2020-153492

Sprint Cell-Site / Tower Reference Table — NEID 211

Document Type: Cellular Network Cell-Site Reference / Tower Lookup Table
Carrier: Sprint
Associated Production: Donyell Holland Sprint Records
Sprint Case Number: 2020-153492
Related Investigation: Randall Leslie homicide investigation / CPD 20-052161
File Name: email-6129837-2020-153492-9259739.xlsx
File Size: approximately 300 KB / 306,726 bytes
File Header: NEID 211 Nashvll-2NWV 07172020
Reference Date Shown: July 17, 2020
Owner Metadata: Sprint Employee
Company Metadata: Sprint

Summary

This spreadsheet is a Sprint cellular tower/reference database for network identifier NEID 211.

It is not another list of Holland’s phone calls.

Instead, it provides the technical lookup information necessary to interpret cell-site identifiers appearing in Sprint call-detail records.

The spreadsheet contains the following fields:

• Cell #

• Cascade ID

• Switch

• NEID

• Latitude

• Longitude

• BTS Manufacturer

• Sector

• Azimuth

• CDR Status

The carrier identifies the network as NEID 211 and the switch as NSVLTN17-MSCe-2.

For each cell site, Sprint provides actual latitude and longitude coordinates.

Sprint also identifies the individual antenna sector and the azimuth, meaning the direction in degrees toward which that sector was oriented.

For example, one Sprint site in the Chattanooga-area portion of the spreadsheet is:

Cell 2960 / Cascade ID CG03XC126

Location:

Latitude: 35.075083
Longitude: -85.170747

Its three sectors are shown with azimuths:

• Sector 1 — 340°

• Sector 2 — 120°

• Sector 3 — 220°

The site was identified as Active.

Another nearby Sprint site is:

Cell 2962 / Cascade ID CG03XC155

Location:

Latitude: 35.060919
Longitude: -85.130369

The table identifies separate directional antenna sectors for that location.

The spreadsheet contains a substantial group of Sprint towers in and around Chattanooga/Hamilton County.

Examples include:

Cell 2851 — CG03XC136
35.053820, -85.213850

Cell 2857 — CG03XC132
35.022367, -85.241825

Cell 2860 — CG60XC001
35.073120, -85.237230

Cell 2866 — CG03XC138
35.070444, -85.264750

Cell 2873 — CG54XC106
35.086028, -85.286222

Cell 2879 — CG21XC002
35.064136, -85.314564

Cell 2882 — CG03XC140
35.073723, -85.319964.

The table continues south and east through additional Chattanooga-area network sites.

For example:

Cell 2974 — CG21XC004
34.985060, -85.202110

Cell 2978 — CG03XC003
34.964364, -85.269244

Cell 2984 — CG03XC002
34.915069, -85.326317.

What This Document Establishes

This spreadsheet establishes that Sprint maintained a detailed reference table capable of translating network cell identifiers into:

• a specific Sprint cell-site number;

• a carrier Cascade ID;

• latitude;

• longitude;

• antenna sector;

• antenna azimuth;

• network switch;

• equipment manufacturer;

• and whether the site was active or nonactive.

It therefore provides the geographic reference component required to interpret Sprint cellular records.

The spreadsheet shows that many Sprint sites in the Chattanooga area used Ericsson equipment and were divided into multiple directional sectors.

This matters because a call-detail record that identifies only a cell number is incomplete for geographic analysis.

With this table, the cell identifier can potentially be connected to:

tower → coordinates → sector → antenna direction.

Important Discovery — Connection to Holland's CDR

The previously reviewed Holland call-detail spreadsheet contains values such as:

• 12960

• 23847

• 32962

• 13857

• 13960

in its 1ST CELL / LAST CELL fields.

This Sprint reference table contains corresponding four-digit cell-site numbers that strongly fit a pattern in which the first digit of the five-digit CDR value may identify the sector and the remaining digits identify the Sprint cell site.

For example:

12960

The table contains Cell 2960, located at:

35.075083, -85.170747

and that tower has a Sector 1 with azimuth 340°.

Likewise:

23847

The table contains Cell 3847 / CG73XC004, located at:

35.110420, -85.162111

and that site has a Sector 2 with azimuth 150°.

Similarly:

13857

corresponds in pattern to Cell 3857 / Sector 1.

Cell 3857 is:

Cascade ID: CG03XC132
Latitude: 35.022367
Longitude: -85.241825
Sector 1 azimuth: 20°.

And:

13960

fits Cell 3960 / Sector 1.

Cell 3960 identifies the same physical Sprint site as another numbered network entry:

CG03XC126
35.075083, -85.170747
Sector 1: 340°.

This pattern is significant, but the exact Sprint encoding convention should be confirmed from the technical documentation contained elsewhere in the Sprint production before treating the first digit as definitively establishing sector number.

Why This Document Matters

This spreadsheet changes the usefulness of Holland’s phone records substantially.

Before finding this document, the CDR contained numbers such as:

12960

but that number alone did not tell us where the network site was.

This table potentially gives us the translation.

If the Sprint encoding convention is confirmed, we can take Holland’s call-detail entries one by one and reconstruct:

date/time → call or text → Sprint cell → latitude/longitude → antenna sector → direction

That gives us a carrier-based geographic timeline of the handset.

This can then be compared against:

• May 27, 2020 witness accounts;

• the 6:35 PM shots-fired report;

• 4088 Teakwood;

• Stockton Drive;

• Holland's statements;

• Derik Brown's movements;

• vehicle movements;

• surveillance footage;

• and other phone records.

This does not mean a cell tower places a handset at one exact address.

Cell-site records generally identify the network site and sector handling a transaction, not the handset's precise GPS coordinates.

A phone can connect to a tower from a substantial surrounding area depending on terrain, network conditions, tower loading, signal propagation, and other factors.

Therefore the correct evidentiary statement is:

The phone used a particular Sprint cell site/sector at a particular time — not that the phone was necessarily sitting at the tower or at one exact address.

Additional Important Point

This appears to be a reference database, not a list limited only to towers Holland actually used.

The spreadsheet includes sites across a broad geographic region.

Therefore, a tower's presence in this spreadsheet does not by itself establish that Holland's phone connected to it.

The actual usage must come from Holland's CDR or other Sprint session records and then be matched against this reference table.

Catalog Category

Digital Evidence / Cell Phones → Sprint Carrier Records → Cell-Site Reference / Tower Lookup → NEID 211 → Donyell Holland Sprint Production

Status: KEEP — HIGH IMPORTANCE

Sprint Large Network / Cell-Location Reference Workbook — Donyell Holland

Document Type: Sprint Cellular Network / Location Reference Data
Carrier: Sprint
Associated Person: Donyell Holland
Sprint Case Number: 2020-153492
Related Investigation: Randall Leslie homicide investigation / CPD 20-052161
File Name: email-6129837-2020-153492-9259746.xlsx
File Size: 6.6 MB
Owner Metadata: Sparks, Jill C [LEG]
Carrier Production Date: August 10, 2020
Status: KEEP — HIGH IMPORTANCE

Summary

This is one of the largest files in the Sprint carrier production concerning Donyell Holland’s cellular records.

At approximately 6.6 MB, it is dramatically larger than Holland’s ordinary call-detail spreadsheet and the approximately 300 KB Sprint NEID 211 cell-site reference table.

Dropbox’s normal text-extraction system cannot read the entire workbook because the file exceeds its 5 MB extraction limit. However, the file is preserved inside the same Holland, Donyell Phone Recs carrier-return package and Dropbox indexes it in connection with geographic/network reference material.

The surrounding Sprint production makes this file particularly important.

We have already identified three separate pieces of the Sprint return:

1. 9245629.xlsx — Holland’s voice/text call-detail records for 423-508-7552;

2. 9259727.xlsx — Holland’s LTE packet-data/session records, including IMSI, device identifier, timestamps, eNode, TAC, IP information, and bytes transferred;

3. 9259739.xlsx — Sprint’s cell-site lookup table for NEID 211, providing cell numbers, latitude, longitude, sectors, and antenna azimuths.

This 6.6 MB 9259746.xlsx is a separate carrier workbook within that same production and appears to contain a substantially larger body of Sprint network/location reference information.

What We Are Seeing in Holland’s Records

The significance of these Sprint files is becoming much clearer.

Holland’s traditional call-detail record contains fields labeled:

1ST CELL
LAST CELL

Some calls contain usable cell identifiers.

For example, earlier records contain numbers such as:

• 12960

• 23847

• 32962

• 13960

• 33960

Those can potentially be translated using Sprint’s cell-site reference data.

We have already confirmed that Sprint’s smaller tower-key workbook contains physical locations and antenna-sector information for Chattanooga-area network sites.

For example, Sprint identifies:

Cell 2960 / CG03XC126
Latitude: 35.075083
Longitude: -85.170747

with three antenna sectors directed at approximately:

• 340°

• 120°

• 220°.

Sprint similarly identifies numerous other Chattanooga-area towers and their sectors in its reference data.

The Critical May 27 Problem

There is an important limitation in Holland’s traditional call-detail spreadsheet.

On May 27, 2020, the ordinary CDR shows several transactions for 423-508-7552, including:

• approximately 7:05 AM — activity involving 865-243-6245;

• approximately 11:04 AM — inbound text activity involving 423-316-1978;

• approximately 12:40 PM — additional activity involving 865-243-6245;

• approximately 10:20 PM — activity involving 423-227-8883.

But those May 27 entries presently show 0 / 0 in the First Cell and Last Cell fields. The May 28 voice records we reviewed likewise show zeroes in those CDR cell-location fields.

That means the ordinary voice-call CDR by itself does not presently give us a tower location for those critical May 27 calls.

That is why the other Sprint files matter so much.

LTE Records May Provide a Separate Location Path

Holland’s separate LTE-data spreadsheet does not depend on the same 1ST CELL / LAST CELL fields.

Instead, it records network information including:

• LTE IMSI;

• device/MEID information;

• timestamps;

• Start / Intermediate / Stop data sessions;

• eNode;

• TAC;

• IP information;

• and data transferred.

That creates a second cellular-location pathway.

If this large 6.6 MB workbook contains the Sprint reference data necessary to translate those LTE network identifiers into physical Sprint sites, it may allow analysis of the handset’s network activity even when the ordinary CDR shows 0 for First Cell and Last Cell.

That would be substantially more useful for the May 27 timeline.

Why This Document Matters

This file should be preserved because we now appear to have the components of a complete cellular-location analysis:

Holland’s transaction records
↓
Holland’s LTE network-session records
↓
Sprint cell-site/network reference records
↓
latitude / longitude / sector information

That creates the possibility of reconstructing the handset’s carrier activity geographically.

The correct analysis would not say that a tower establishes Holland’s precise physical location.

Instead, it could establish that the handset associated with Holland’s Sprint account communicated through a particular Sprint network site or sector at a particular time.

That can then be compared against:

• 4088 Teakwood;

• the May 27 shots-fired report;

• the time Randall Leslie disappeared;

• Kiara Carson’s timeline;

• witness statements concerning Holland’s movements;

• Stockton Drive;

• vehicle movements;

• Brown’s phone records;

• and the later investigative narrative.

Important Distinction

A tower connection is not GPS.

A cellular site can serve devices over a surrounding geographic area. Sector direction, terrain, signal conditions, network load, and other factors affect which site serves a handset.

Therefore, even after decoding the network information, the evidence should be described as:

“The handset utilized this Sprint tower/site/sector at this time.”

It should not be described as:

“Holland was standing at this exact address.”

What This Document Establishes Right Now

At this stage, the source record establishes that:

• 9259746.xlsx is a separate Excel workbook in Holland’s Sprint carrier-return records;

• it is approximately 6.6 MB, making it by far one of the largest Sprint spreadsheets in the package;

• it was preserved with Holland’s cellular evidence;

• its metadata identifies Sparks, Jill C [LEG] as owner;

• it belongs to the same Sprint case-number series as the CDR, LTE-session data, and tower-reference records;

• and it warrants separate preservation and analysis rather than being treated as a duplicate.

Because the workbook exceeds Dropbox’s extraction limit, the exact internal column structure should not yet be stated as established fact until the workbook itself is directly parsed.

Investigative Significance

HIGH.

The single biggest question now is whether this workbook provides the network-site lookup needed for Holland’s LTE eNode/TAC records.

If it does, this could be the file that lets us determine what network sites Holland’s phone was communicating with during periods where his ordinary call-detail records contain zeroes for tower information.

That is exactly the gap we encountered on May 27.

Catalog Category

Digital Evidence / Cell Phones → Sprint Carrier Records → Network / Cell-Location Reference Data → Donyell Holland → Sprint Case 2020-153492

STATUS: KEEP — HIGH IMPORTANCE — LARGE WORKBOOK REQUIRES DIRECT DATA EXTRACTION

Verizon Custodian-of-Records Certification — Case 200184085

Document Type: Carrier Records Certification / Business-Records Authentication
Carrier: Verizon
Department: Verizon Security — Court Order Compliance
Verizon Case Number: 200184085
Requesting Agency: Chattanooga Police Department
Agency Address: 3410 Amnicola Highway, Chattanooga, Tennessee
Certification Date: August 9, 2020
Custodian of Records: Danielle Fanelli
Related Production: Holland Verizon Records
File Name: 200184085_Certification.pdf
Document Length: 1 page

Summary

This document is a formal Verizon custodian-of-records certification accompanying a production of electronic cellular records provided to the Chattanooga Police Department.

The certification is dated August 9, 2020 and identifies the carrier matter as:

Verizon Case # 200184085

The document was issued by:

Verizon Security — Court Order Compliance
Bedminster, New Jersey.

The certification is sworn by Danielle Fanelli, who identifies herself as a custodian of records for Verizon.

Fanelli certifies that the electronic files attached to the carrier production are true and accurate copies of records created from information maintained by Verizon in the ordinary course of business.

She further certifies that Verizon ordinarily maintains those types of records and that the records were made contemporaneously with the transactions or events reflected in them, or within a reasonable time afterward.

In plain language, Verizon is saying:

These electronic files came from Verizon’s own business-record systems and accurately reproduce the records Verizon maintained.

What This Document Establishes

This certification establishes that:

• Verizon made an electronic records production to the Chattanooga Police Department;

• Verizon assigned that production case number 200184085;

• the certification was dated August 9, 2020;

• Danielle Fanelli was acting as a Verizon custodian of records;

• Verizon represented that the attached electronic files were true and accurate copies of records maintained by Verizon;

• Verizon represented that those records were maintained in its ordinary course of business;

• and Verizon represented that the underlying records were created contemporaneously with the transactions/events recorded or within a reasonable time thereafter.

What This Document Does NOT Establish

The certification itself does not establish:

• where Holland was physically located;

• who personally possessed or operated a phone;

• that any particular call was made by Holland personally;

• the meaning of any tower or sector;

• the content of calls or text messages;

• that a particular investigative interpretation of the carrier data is correct;

• or that every file in the defense Dropbox folder was necessarily part of this Verizon production.

Those conclusions have to come from the actual carrier data files that this certification accompanies.

Why This Document Matters

This document is important because it gives the underlying Verizon records carrier provenance.

Without the certification, an Excel spreadsheet or electronic carrier file could simply appear in a police or defense folder with little indication of who created it.

This certification establishes that Verizon itself represented the associated electronic records as records generated from information maintained in Verizon’s ordinary business systems.

That is particularly useful when examining:

• call-detail records;

• subscriber records;

• cell-site records;

• tower/site keys;

• IP-session records;

• location-related network data;

• and other electronic Verizon returns contained in the same production.

It also means the underlying Verizon records should be analyzed as primary carrier records, rather than merely as a police-created summary of phone activity.

Important Connection to the Current Phone Review

The file is being previewed from:

Holland Verizon_Records.zip

That means we have now moved into a separate Verizon carrier-record package within Holland’s phone materials.

This is important because the Sprint records we were just reviewing and this Verizon package should not automatically be mixed together.

Each carrier production needs to be tracked separately by:

• carrier;

• carrier case number;

• phone number;

• device identifier;

• requested date range;

• production date;

• and the specific records returned.

For this Verizon package, the controlling carrier identifier is:

Verizon Case # 200184085

The files accompanying this certification should therefore be cataloged under that Verizon case number unless the individual document shows otherwise.

Catalog Category

Digital Evidence / Cell Phones → Verizon Carrier Records → Certifications & Authentication → Verizon Case 200184085 → Holland Phone Records

STATUS: KEEP — IMPORTANT AUTHENTICATION / PROVENANCE DOCUMENT

Stokes Email — Sprint Cellular Records for Donyell Holland

Document Type: Law-Enforcement Email / Carrier-Records Transmission
Carrier: Sprint
Agency: Chattanooga Police Department
CPD Complaint Number: 20-052161
Sprint Case Number: 2020-153492
Associated Person: Donyell Holland — as expressly identified by Corey Stokes
Original Sprint Transmission Date: August 10, 2020 at 4:24 PM
Forwarded by Corey Stokes: September 29, 2021 at 10:55 AM
Original Sender: Sprint Subpoena Compliance / sts-noreply@sprint.com
Sprint Contact Named: Shawna Sallaz, Subpoena Specialist
Original Recipient: Corey Stokes, Chattanooga Police Department
Forwarded To: Yolanda Massey, City of Chattanooga
Document Length: 2 pages
File Name: Leslie, Randall 20-052161 Stokes Email Re Donyell Holland Cell Recs.pdf

Summary

This two-page City of Chattanooga email is the transmission and provenance record for the Sprint cellular evidence associated by Investigator Corey Stokes with Donyell Holland.

The underlying carrier email was sent directly from Sprint Subpoena Compliance to Corey Stokes on August 10, 2020 at 4:24 PM.

Its subject line was:

“Sprint case 2020-153492.”

Sprint advised Stokes that the email was being sent in response to his request for records and instructed him to reference Sprint case number 2020-153492 with any questions concerning the response. The carrier email identifies Shawna Sallaz, Subpoena Specialist, Sprint Subpoena Compliance, Corporate Security as the Sprint contact.

Sprint also stated that the records were being transmitted electronically at the request of the recipient and included confidentiality and electronic-transmission notices.

More than a year later, on September 29, 2021 at 10:55 AM, Stokes forwarded the original Sprint email and its attachments to Yolanda Massey.

Stokes inserted a short but important identifying statement:

“Holland’s Sprint records 20-52161.”

That statement is the direct police-generated link between:

• Donyell Holland;

• Sprint case 2020-153492;

• CPD complaint 20-052161;

• and the nine electronic attachments transmitted by Sprint.

The Nine Sprint Attachments

The email identifies nine attachments in the original Sprint production:

1. email-6129837-2020-153492-9259622.tif — 626 KB

2. email-6129837-2020-153492-9259624.tif — 402 KB

3. email-6129837-2020-153492-9259765.rtf — 58 KB

4. email-6129837-2020-153492-9245629.xlsx — 22 KB

5. email-6129837-2020-153492-9259739.xlsx — 300 KB

6. email-6129837-2020-153492-9259750.rtf — 733 KB

7. email-6129837-2020-153492-9259727.xlsx — 21 KB

8. email-6129837-2020-153492-9259746.xlsx — 6,760 KB

9. email-6129837-2020-153492-9259752.rtf — 92 KB.

Several of those files have now been independently reviewed.

Known Contents of the Production

9245629.xlsx — Call Detail Records

This spreadsheet contains Sprint voice-call and text-detail transactions for PTN 423-508-7552, including timestamps, duration, call type, NEID, First Cell, and Last Cell information.

It covers the important May 2020 investigative period.

9259727.xlsx — LTE Data Session Records

This spreadsheet contains LTE network-session data associated with 423-508-7552, including:

• LTE IMSI;

• device/MEID field;

• timestamps;

• Start / Intermediate / Stop session information;

• bytes sent and received;

• eNode information;

• TAC information;

• and network/IP data.

This provides a separate source of network activity from the ordinary voice-call CDR.

9259739.xlsx — Sprint Cell-Site Reference Table

This spreadsheet contains Sprint's NEID 211 cell-site reference data, including:

• Cell Number;

• Cascade ID;

• Switch;

• latitude;

• longitude;

• antenna sector;

• azimuth;

• BTS manufacturer;

• and active/nonactive status.

This is the carrier key that can potentially translate cell identifiers appearing in Sprint records into real network-site locations.

9259746.xlsx — Large Sprint Workbook

This approximately 6.6 MB spreadsheet is the largest workbook in the carrier production.

Its exact internal structure has not yet been completely extracted because of its size, so its contents should remain separately cataloged without assuming precisely what every table contains.

9259622.tif and 9259624.tif

These are two distinct image-only Sprint attachments.

Their provenance is established by this email, but their precise visual contents have not yet been completely identified and should remain marked for visual review.

The three RTF files — 9259765.rtf, 9259750.rtf, and 9259752.rtf — are also separate carrier attachments and should be individually reviewed before assigning their precise functions.

What This Document Establishes

This email directly establishes that:

• Sprint responded to a law-enforcement records request under Sprint case 2020-153492;

• Sprint transmitted that response directly to Corey Stokes on August 10, 2020 at 4:24 PM;

• the carrier response consisted of nine separate electronic attachments;

• Stokes possessed that carrier production;

• Stokes later expressly identified the production as “Holland’s Sprint records 20-52161”;

• Stokes forwarded the carrier email and attachment list to Yolanda Massey on September 29, 2021;

• the production included spreadsheets, RTF records, and TIFF images;

• and the files we are now reviewing belong to one identifiable Sprint carrier production rather than being unrelated spreadsheets collected later.

What This Document Does NOT Establish

This email does not by itself establish:

• that every record transmitted by Sprint was introduced at trial;

• that every record was disclosed to Holland or his defense at a particular time;

• that Stokes personally analyzed every attachment;

• that the phone was physically in Holland’s possession during every recorded transaction;

• that a tower connection establishes Holland’s exact physical location;

• or that any particular police interpretation of the carrier evidence was correct.

Those issues require comparison with discovery records, trial exhibits, testimony, property records, and the underlying Sprint data.

Why This Document Matters

This is a major chain-of-provenance document for Holland’s cellular evidence.

Before this email, an individual Excel file with a computer-generated filename such as:

email-6129837-2020-153492-9259727.xlsx

could be difficult to understand in isolation.

This email establishes that these strangely named files were attachments transmitted together by Sprint under one carrier case number.

That allows the entire package to be reconstructed accurately.

The sequence is:

Sprint records request
↓
Sprint case 2020-153492
↓
Sprint sends nine files to Corey Stokes on August 10, 2020
↓
Stokes identifies them as “Holland’s Sprint records 20-52161”
↓
Stokes forwards them internally on September 29, 2021

That is much stronger provenance than merely finding the files in a Dropbox folder.

Timing Significance

The August 10, 2020 production date is particularly important.

It establishes that Sprint had provided the cellular records to Stokes during the original homicide investigation, only weeks after Randall Leslie’s body was located.

Therefore, at least by August 10, investigators had received a carrier package containing Holland’s:

• call-detail data;

• cellular/network information;

• and supporting Sprint records.

That date should be preserved when examining what investigators knew and when they knew it.

It should also be compared against:

• subsequent police supplements;

• witness interviews;

• charging decisions;

• search-warrant affidavits;

• grand-jury proceedings;

• discovery production;

• later prosecution theories;

• and trial testimony concerning cellular evidence.

Critical May 27 Location Issue

The Sprint package has become particularly important because Holland’s ordinary CDR contains several transactions on May 27, 2020, but the First Cell and Last Cell fields for the critical May 27 entries we examined are shown as 0 / 0.

That means the ordinary voice-call CDR alone does not presently provide a usable tower identifier for those specific transactions.

However, Sprint also produced separate:

• LTE session records;

• cell-site reference records;

• and additional large technical workbooks.

Therefore, the absence of a tower number in those particular CDR rows does not automatically mean Sprint possessed no other network-location information for the handset during that period.

The remaining Sprint files need to be analyzed before reaching that conclusion.

Discovery / Disclosure Significance

This email also gives us a precise package to look for in the discovery history:

Sprint case 2020-153492 — nine attachments.

That provides a concrete comparison point.

The relevant question is not merely whether “phone records” appear somewhere in discovery.

The better question is whether the record shows that the complete nine-attachment Sprint production was preserved, produced, disclosed, reviewed, or introduced.

The September 29, 2021 forwarding email proves that Stokes still had access to the package at that time.

It does not, standing alone, establish when or whether the complete package was provided to the defense.

Catalog Category

Digital Evidence / Cell Phones → Sprint Carrier Records → Transmission & Provenance Correspondence → Donyell Holland → Sprint Case 2020-153492

STATUS: KEEP — HIGH IMPORTANCE

Sprint Subpoena Compliance Return — Donyell Holland / 423-508-7552

Document Type: Carrier Records Return Letter / Request-by-Request Compliance Summary
Carrier: Sprint
Department: Sprint Corporate Security — Subpoena Compliance
Sprint Representative: Shawna Sallaz, Subpoena Specialist
Requesting Investigator: C. Stokes, Chattanooga Police Department
CPD Reference Case Number: 2052161 / 20-052161
Sprint Case Number: 2020-153492
Subject Phone Number: 423-508-7552
Requested Date Range: May 1, 2020 at 12:00 AM through June 1, 2020 at 11:59:59 PM
Carrier Return Date: August 10, 2020
File Name: email-6129837-2020-153492-9259765.rtf
Document Length: 6 pages

Summary

This six-page Sprint document is one of the most useful records in the Holland cellular-production package because it explains exactly what Chattanooga Police requested from Sprint and what Sprint returned for each category of requested information.

The document is dated August 10, 2020 and is addressed directly to C. Stokes of the Chattanooga Police Department.

Sprint identifies the matter as:

Sprint Case Number: 2020-153492

and identifies the police matter as:

Reference Case Number: 2052161

The subject telephone number is:

423-508-7552

The requested period was:

May 1, 2020 through June 1, 2020

That date range covers the entire period immediately preceding and surrounding Randall Leslie’s disappearance on May 27, 2020.

Sprint states that it is enclosing the requested information for the specified period and provides instructions for future inquiries and trial authentication.

Sprint also specifically advises that if the records are used in court and a records custodian is required, its trial team is located at Sprint corporate headquarters in Overland Park, Kansas, and requires advance notice and prepaid travel arrangements.

The document additionally references Sprint L-Site, described as an interactive web tool for law enforcement.

Sprint’s Request-by-Request Results

The most important part of this document is the section titled:

Sprint Requested Information

Sprint identifies each category requested by police and states whether records were found.

1. Voicemail Access

Date Range: May 1, 2020 through June 1, 2020
Subject Number: 423-508-7552

Sprint states:

No voicemail messages were found for the requested period.

However, Sprint provides an important explanation.

Sprint states that the request was outside the voicemail retrieval period.

Sprint explains that:

• saved voicemail messages are stored on its server for approximately 20 days;

• new voicemail messages that have not been listened to are stored for approximately 5 days;

• and messages deleted by the subscriber cannot be retrieved.

Why the Voicemail Result Matters

This means the absence of voicemail content does not establish that no voicemail messages existed during May 2020.

The request was returned on August 10, 2020—well outside Sprint’s stated voicemail-retention period for the requested May records.

Therefore, the accurate conclusion is:

Sprint could not produce voicemail messages because the request fell outside the carrier’s retrieval window.

It should not be stated as:

“There were no voicemail messages.”

That distinction is important.

2. Payment Information

Date Range: May 1, 2020 through June 1, 2020
Subject Number: 423-508-7552

Sprint states:

No records were found for this number during the requested time period.

This means Sprint produced no payment-information records responsive to this request for the specified date range.

It does not, without additional carrier explanation, establish why no payment records existed.

3. CDR with Cell Site

Date Range: May 1, 2020 through June 1, 2020
Subject Number: 423-508-7552

Sprint states:

The requested records were attached.

This is extremely important.

It confirms that Sprint did produce Call Detail Records with Cell Site information in response to Stokes’s request.

That category corresponds with the Sprint CDR spreadsheet already identified in this production.

The carrier itself describes the requested category as:

CDR w/Cell Site

Therefore, the cell fields appearing in Holland’s Sprint call-detail records were not incidental fields in a generic billing record.

Stokes specifically requested call-detail records with cellular-site information, and Sprint expressly states that it supplied responsive records.

4. Customer Account Notes

Date Range: May 1, 2020 through June 1, 2020
Subject Number: 423-508-7552

Sprint states:

No records were found for this number during the requested time period.

This means Sprint did not produce customer-account-note records responsive to the specified period.

5. PCMD

Date Range: May 1, 2020 through June 1, 2020
Subject Number: 423-508-7552

Sprint states:

No records were found for this target during the requested time period.

This is important because police specifically requested PCMD information, but Sprint states that it had no responsive records for the target during the requested period.

The document itself does not define PCMD on these pages, so the exact technical meaning should be taken from Sprint’s own technical materials if available rather than inferred.

The documented fact is simply:

PCMD was requested; Sprint reported no responsive records.

6. Stored Content

Date Range: May 1, 2020 through June 1, 2020
Subject Number: 423-508-7552

Sprint states:

No records were found for this number during the requested time period.

This means Sprint did not produce stored-content records responsive to the request.

The document does not establish what specific forms of “stored content” Stokes requested within that category, so no broader conclusion should be drawn without the underlying legal demand.

7. Make and Model

Date Range: May 1, 2020 through June 1, 2020
Subject Number: 423-508-7552

Sprint states:

“Please see attached.”

This directly establishes that Sprint produced responsive device make-and-model information.

One of the remaining Sprint attachments therefore should contain information identifying the handset or device associated with 423-508-7552.

That information should be compared directly against:

• the physical phone attributed to Holland;

• CPD property records;

• any forensic extraction;

• IMEI/MEID information;

• and the LTE session records.

8. IPDR with Cell Site

Date Range: May 1, 2020 through June 1, 2020
Subject Number: 423-508-7552

Sprint states:

Responsive records were found and attached.

This is one of the most important statements in the entire document.

Police specifically requested:

IPDR w/Cell Site

and Sprint states that it produced responsive records for the requested period.

This confirms that Sprint provided police not only ordinary voice-call CDRs but also internet/data-session records containing cell-site information.

That directly explains why the production includes separate LTE/IP data spreadsheets in addition to the traditional call-detail record.

What This Document Establishes

This document directly establishes that Stokes requested multiple categories of cellular evidence concerning 423-508-7552 for the period May 1 through June 1, 2020.

Sprint’s response establishes the following:

Records produced:

• CDR with Cell Site;

• Make and Model information;

• IPDR with Cell Site.

No responsive records reported:

• Payment Information;

• Customer Account Notes;

• PCMD;

• Stored Content.

Voicemail:

• no voicemail produced;

• Sprint specifically explained that the request was outside its retrieval period.

This is substantially more informative than simply knowing that “Sprint phone records” existed.

It tells us the exact categories available to investigators.

Why This Document Matters

This document is highly important because it confirms that cell-location information was an explicit part of Stokes’s Sprint request.

Stokes did not merely request telephone billing records.

He requested:

CDR w/Cell Site

and separately:

IPDR w/Cell Site

Sprint states that it found and attached records responsive to both categories.

That gives the cellular-location analysis two separate evidence streams:

VOICE / CALL ACTIVITY

CDR with Cell Site

and

INTERNET / DATA ACTIVITY

IPDR with Cell Site

That is a significant distinction.

The traditional CDR we reviewed contains some rows where First Cell and Last Cell contain usable numbers, but the critical May 27 records we examined show zeroes.

Those zeroes therefore do not end the inquiry.

Sprint independently states here that it produced IPDR with Cell Site records for the same requested period.

That means the data-session records must be examined separately to determine what cell-site information Sprint retained for the handset during periods when the voice CDR did not contain a usable cell identifier.

Critical May 27 Significance

The requested period includes May 27, 2020, the central date in the Leslie investigation.

Sprint confirms that responsive CDR with Cell Site and IPDR with Cell Site records existed for the overall May 1–June 1 period and were supplied to Stokes.

Accordingly, the proper inquiry is not merely:

“Does Holland’s May 27 voice CDR show a tower?”

The more complete inquiry is:

“What cell-site information appears anywhere in Sprint’s CDR and IPDR production for Holland’s handset on May 27?”

That requires combining:

• 9245629.xlsx — CDR;

• 9259727.xlsx — LTE/IP-session information;

• 9259739.xlsx — cell-site reference information;

• 9259746.xlsx — the large Sprint workbook;

• and any technical RTF files defining the data.

Another Important Point — The Request Was Broad

Police sought considerably more than basic call logs.

They requested:

• voicemail;

• payment records;

• CDR with cell site;

• customer account notes;

• PCMD;

• stored content;

• device make/model;

• and IPDR with cell site.

This demonstrates that investigators were seeking a fairly comprehensive picture of the cellular account and handset.

That matters when evaluating what cellular evidence investigators possessed, what information was unavailable, and what categories were later relied upon or omitted.

Authentication / Trial Use

Sprint also expressly discussed authentication if these records were used at trial.

Sprint advised police that a corporate records custodian could be made available through its Trial Team, subject to advance notice and travel arrangements.

Therefore, the carrier itself provided police with a pathway for authenticating the records as business records in court.

That should be compared against the trial record to determine:

• whether these Sprint records were introduced;

• which Sprint records were introduced;

• whether a custodian testified;

• whether the records were otherwise authenticated;

• and whether the complete Sprint production was presented or only selected portions.

Discovery Significance

This document gives us another strong inventory check.

The carrier says the production included responsive records for:

CDR w/Cell Site
Make and Model
IPDR w/Cell Site

If those categories were produced to Stokes on August 10, 2020, the discovery record can be checked for whether those same categories were later supplied to the defense.

The carrier return gives us a benchmark for what the original police production contained.

Catalog Category

Digital Evidence / Cell Phones → Sprint Carrier Records → Carrier Return / Request Results → Donyell Holland / 423-508-7552 → Sprint Case 2020-153492

STATUS: KEEP — HIGH IMPORTANCE

T-Mobile Carrier Attachment — Unidentified Three-Page PDF / Holland Phone Records

Document Type: Carrier-Records Attachment / Image-Only PDF
Carrier: T-Mobile
Associated Person: Donyell Holland — based on its location within the Holland T-Mobile phone-record production
Related Investigation: Randall Leslie homicide investigation / CPD 20-052161
File Name: 14f1d34d-0d5b-4677-a1ac-548e8804d245.PDF
Document Length: 3 pages
File Size: approximately 76 KB / 78,137 bytes
Production Group: Holland T-Mobile Phone Records
Content Status: Image-only / no extractable text

Summary

This three-page PDF is an original file preserved within the Holland T-Mobile carrier-record package.

Dropbox places the file directly in:

(09) Search Warrants → Holland Tmobile

and duplicate copies also appear in the case-file directories labeled “Holland, Donyell TMobile Phone Recs.”
The filename is a computer-generated UUID:

14f1d34d-0d5b-4677-a1ac-548e8804d245.PDF

so the filename itself does not identify the document's substantive purpose.

The PDF contains three pages, but Dropbox's text extractor returns no readable text from the document. Therefore, its exact contents cannot responsibly be described from the electronic text layer.

The file should nevertheless be retained because it is one of only nine files in the T-Mobile production folder, and the surrounding files demonstrate that this package contains substantive carrier evidence.

The Nine-File T-Mobile Package

The same folder contains:

1. 14f1d34d-0d5b-4677-a1ac-548e8804d245.PDF — this three-page unidentified PDF

2. 2883759 Certification.pdf — T-Mobile records certification

3. 2883759_Timing_Advance_Date_Range.pdf — timing-advance/location-related records

4. 2883759_UTR.pdf — carrier record associated with T-Mobile matter 2883759

5. CDR_Mediations_5614522343_8240375.xls — call-detail records

6. SUB_AmdocsTibco_5614522343_8240376.xls — subscriber information

7. Interpreting Call Detail Records - 02252020.pdf — T-Mobile technical interpretation guide

8. Interpreting Subscriber Information 20190708.pdf — subscriber-record interpretation guide

9. UTC Information Sheet 05252018.pdf — time-zone/time-conversion reference sheet

That package structure tells us something important: this PDF is not an isolated miscellaneous document. It was preserved alongside the actual T-Mobile CDR, subscriber, timing-advance, certification, and carrier-interpretation records.

What This Document Establishes

At this point, the document itself establishes only that:

• it is a three-page PDF;

• it is part of the Holland T-Mobile phone-record materials;

• identical copies appear within multiple duplicated Holland case-file directories;

• it was preserved with the substantive T-Mobile carrier production;

• and its pages do not contain a usable machine-readable text layer.

What it does not yet establish is whether the three pages are:

• a carrier return letter;

• account information;

• a legal-demand cover sheet;

• search results;

• subscriber information;

• technical network information;

• a warrant or order;

• a carrier response;

• or some other T-Mobile document.

Those descriptions would be speculation until the page images can be read.

Why This Document Matters

This file should not be discarded simply because its filename is meaningless or its preview appears nearly blank.

Its surrounding folder is clearly a structured T-Mobile legal-compliance production.

The package contains a T-Mobile certification identified as 2883759, a CDR spreadsheet, subscriber-information spreadsheet, timing-advance records, and carrier interpretation guides.

That means this unidentified PDF may provide context, identification, transmission information, or some other component of the same carrier return.

The precise relationship should be determined by comparing it with:

• 2883759 Certification.pdf

• 2883759_UTR.pdf

• 2883759_Timing_Advance_Date_Range.pdf

• CDR_Mediations_5614522343_8240375.xls

• SUB_AmdocsTibco_5614522343_8240376.xls

Important New Development

This folder also establishes that Holland's cellular evidence was not limited to the Sprint production we just reviewed.

There is a separate T-Mobile production containing:

• call-detail records;

• subscriber records;

• timing-advance information;

• technical interpretation instructions;

• and a carrier certification.

That needs to remain completely separate from Sprint's records during the analysis.

In particular, the presence of a file explicitly titled:

2883759_Timing_Advance_Date_Range.pdf

is potentially significant for location analysis.

T-Mobile's timing-advance evidence is a different type of cellular-location evidence from the Sprint CDR/IPDR material and needs its own examination.

Catalog Category

Digital Evidence / Cell Phones → T-Mobile Carrier Records → Original Carrier Attachments → Donyell Holland → Unidentified Three-Page PDF

STATUS: KEEP — VISUAL REVIEW REQUIRED

T-Mobile Custodian Certification — Case 2883759 / 561-452-2343

Document Type: Carrier Records Certification / Business-Records Authentication
Carrier: T-Mobile US, Inc. / MetroPCS
Department: Law Enforcement Relations
T-Mobile Tracking ID / Case Number: 2883759
Custodian of Records: Andrew Dios
Certification Date: September 2, 2020
MSISDN / Identifier: 561-452-2343
Requested Date Range: May 1, 2020 through June 1, 2020
Certified Record Categories: Call Details With Cell Sites; Subscriber Information
Associated Production: Holland T-Mobile Phone Records
File Name: 2883759 Certification.pdf
Document Length: 1 page

Summary

This one-page document is T-Mobile's formal custodian-of-records certification for electronic cellular records produced under T-Mobile / MetroPCS Tracking ID 2883759.

The certification is dated September 2, 2020 and was issued by T-Mobile's Law Enforcement Relations office in Parsippany, New Jersey.

The declaration is made by Andrew Dios, who identifies himself as a Custodian of Records for T-Mobile US, Inc.

Dios declares under penalty of perjury pursuant to 28 U.S.C. § 1746 that the certification is true and correct.

He states that the electronic records produced in T-Mobile Case No. 2883759 were produced in response to a lawful request issued to T-Mobile.

Most importantly, the certification identifies the precise records T-Mobile produced and certified.

The table identifies:

MSISDN / Identifier: 5614522343
Start Date: 05/01/2020
End Date: 06/01/2020
Requested Item: Call Details With Cell Sites

and separately:

MSISDN / Identifier: 5614522343
Start Date: 05/01/2020
End Date: 06/01/2020
Requested Item: Subscriber Info

Therefore, this certification authenticates a T-Mobile production concerning 561-452-2343, covering the same critical May 2020 period we have been examining.

What T-Mobile Certifies

Andrew Dios certifies that the records attached to the certification are:

• duplicates of the original records;

• true copies of records maintained by T-Mobile;

• complete copies of the records being produced;

• records made at or near the time of the events reflected in them;

• made by, or from information transmitted by, someone with knowledge;

• maintained in the course of T-Mobile's regularly conducted business;

• and records that T-Mobile routinely creates as part of its business practice.

The certification further states that, where a record is not the original, it is a duplicate of the original.

Authentication Purpose

T-Mobile expressly states that the certification is intended to satisfy:

• Federal Rule of Evidence 803(6);

• Federal Rule of Evidence 902(11);

• Federal Rule of Evidence 902(13);

• Federal Rule of Evidence 902(14);

• and corresponding state-law equivalents.

That statement is significant because T-Mobile itself was preparing the electronic carrier records for use as authenticated business and electronic records without necessarily requiring a carrier witness to establish every foundational fact in person.

The certification should therefore remain attached conceptually to the underlying CDR and subscriber-information files.

What This Document Establishes

This document directly establishes that:

• T-Mobile received a lawful records request;

• T-Mobile assigned the request Case / Tracking ID 2883759;

• T-Mobile produced electronic records in response;

• the subject identifier was 561-452-2343;

• the requested period was May 1, 2020 through June 1, 2020;

• T-Mobile produced Call Details With Cell Sites;

• T-Mobile produced Subscriber Information;

• those records were certified by a T-Mobile custodian of records;

• and T-Mobile represented the records as true and complete copies of records maintained in its regular business systems.

Important Difference From the Sprint Production

This T-Mobile production concerns a different telephone number from the Sprint production we just reviewed.

The Sprint production concerned:

423-508-7552

This T-Mobile certification concerns:

561-452-2343

Those two numbers should not be merged into one phone record merely because both packages are stored under Holland's phone-record folders.

The T-Mobile certification itself does not name Donyell Holland anywhere in the text you provided.

The connection to Holland presently comes from the location of these records in folders labeled:

Holland Tmobile / Holland, Donyell TMobile Phone Recs

The subscriber-information spreadsheet in this same T-Mobile production should tell us who T-Mobile's records actually identify as the subscriber or account associated with 561-452-2343.

That is an important distinction.

Until we read that subscriber file, the disciplined statement is:

T-Mobile certified records for 561-452-2343 were preserved within the Holland T-Mobile phone-record production.

It should not yet be stated solely from this certification that T-Mobile independently identified Donyell Holland as the subscriber.

Why This Document Matters

This certification is extremely important for the T-Mobile evidence because it confirms that the associated files are not police-created summaries.

They are carrier-produced records originating from T-Mobile's own business systems.

It also confirms that T-Mobile specifically produced cell-site information.

The requested item is not simply described as:

Call Details

It is expressly described as:

Call Details With Cell Sites

That means the CDR spreadsheet in this nine-file package should contain carrier-generated information capable of showing which T-Mobile cell sites handled particular transactions.

This should be analyzed together with:

• CDR_Mediations_5614522343_8240375.xls

• SUB_AmdocsTibco_5614522343_8240376.xls

• 2883759_Timing_Advance_Date_Range.pdf

• 2883759_UTR.pdf

• Interpreting Call Detail Records - 02252020.pdf

• Interpreting Subscriber Information 20190708.pdf

• UTC Information Sheet 05252018.pdf

Timing-Advance Significance

The presence of a separate file named:

2883759_Timing_Advance_Date_Range.pdf

alongside a certified Call Details With Cell Sites production is especially important.

The certification itself does not say what the Timing Advance document contains, so we should not assign conclusions to it yet.

But T-Mobile's certified production clearly includes cellular-site evidence, and the separate timing-advance record should be analyzed independently when we reach it.

That may provide a more detailed form of network-location information than a simple tower identifier.

Discovery / Evidence Inventory Significance

This certification gives us an exact benchmark for what the T-Mobile production should contain.

For T-Mobile Case 2883759, at minimum we should be able to account for:

1. Call Details With Cell Sites

2. Subscriber Information

for:

561-452-2343

covering:

May 1, 2020 through June 1, 2020

If either of those underlying carrier records is missing from a discovery copy, incomplete, or represented differently elsewhere, this certification provides the carrier's own description of what was produced.

What This Document Does NOT Establish

This certification does not establish:

• that Donyell Holland was the subscriber;

• that Holland personally possessed the handset during every transaction;

• that Holland personally made every call;

• that a cell site gives an exact GPS location;

• what any particular call or text contained;

• how prosecutors interpreted the records;

• whether the full T-Mobile production was introduced at trial;

• or whether the complete carrier production was disclosed to the defense.

Those questions require the underlying T-Mobile files and the case/discovery record.

Catalog Category

Digital Evidence / Cell Phones → T-Mobile Carrier Records → Certifications & Authentication → T-Mobile Case 2883759 → MSISDN 561-452-2343

STATUS: KEEP — HIGH IMPORTANCE

T-Mobile TrueCall / Timing Advance — Request to Reduce Date Range

Document Type: Carrier Location-Data Limitation Notice / Request to Narrow Legal Demand
Carrier: T-Mobile US, Inc.
Department: Law Enforcement Relations
T-Mobile Tracking ID: 2883759
Associated Target: T-Mobile production containing records for 561-452-2343
Related Investigation: Randall Leslie homicide investigation / Holland T-Mobile phone-record materials
File Name: 2883759_Timing_Advance_Date_Range.pdf
File Size: approximately 1.17 MB
Purpose: Notice concerning requested historical TrueCall / Timing Advance location data

Summary

This document is not the actual Timing Advance location data.

It is a formal notice from T-Mobile Law Enforcement Relations sent in response to a law-enforcement request for historical location information from T-Mobile's TrueCall system.

The document states that law enforcement requested that T-Mobile produce historical location data pursuant to a search warrant or probable-cause order.

Before collecting and producing that data, T-Mobile required the requesting agency to review several important limitations concerning the TrueCall system.

T-Mobile then required law enforcement to reduce the requested time period.

The carrier states that it will produce a maximum of:

7 consecutive days of TrueCall / Timing Advance data per target telephone number.

T-Mobile further states that it will formally object to a request seeking a broader period.

The document is specifically associated with:

Tracking ID 2883759

which is the same tracking number appearing on the T-Mobile records certification we just reviewed.

T-Mobile's Own Warnings About TrueCall Data

The most important portion of this document is T-Mobile's description of the limitations of its own historical-location system.

T-Mobile states that it:

does not rely on TrueCall data to manage individual customer accounts.

More importantly, T-Mobile states that it is:

unable to certify the accuracy of TrueCall data at the individual account-holder level.

T-Mobile also states that it:

does not conduct systematic testing of TrueCall data to determine the reliability or consistency of the location information it collects.

That is an unusually important carrier qualification.

It means T-Mobile itself was warning law enforcement that this information should not simply be treated as a carrier-verified, precise representation of an individual subscriber's historical location.

T-Mobile Does Not Routinely Collect TrueCall Everywhere

The notice also states that:

• T-Mobile does not routinely collect TrueCall data;

• TrueCall data is not available in every market;

• and availability therefore varies geographically.

So the existence of a T-Mobile account or CDR does not automatically mean corresponding TrueCall/Timing Advance information existed for every transaction or every location.

Certification Limitation

T-Mobile distinguishes records based upon when the Timing Advance records were prepared.

The carrier states that for Timing Advance records prepared October 14, 2019 and later, T-Mobile will certify them as business records under applicable evidence rules.

However, even for those records, T-Mobile expressly states that it will not provide testimony regarding the details of the collection, substance, and interpretation of the information.

For Timing Advance records prepared before October 14, 2019, T-Mobile states that it cannot certify them and will not provide testimony concerning their accuracy.

The Holland investigation concerns 2020, so the post-October-2019 certification provision would be the relevant one if Timing Advance records were ultimately produced.

But certification as a business record is not the same thing as T-Mobile certifying the accuracy of the historical-location conclusion.

That distinction is crucial.

TrueCall Retention Period

T-Mobile states that TrueCall records are retained for approximately:

0 to 120 days, depending on the market.

This means the availability of historical-location information was time-sensitive.

If investigators did not obtain the data while it remained available, portions of the information could cease to exist.

Seven-Day Limitation

T-Mobile instructed law enforcement that if it still wanted TrueCall data after reviewing the carrier's warnings, it had to narrow the request to the dates for which the information was “absolutely critical.”

The carrier would produce:

up to seven days per target.

Law enforcement was instructed to resubmit the warrant/order with a cover sheet identifying the reduced date range.

T-Mobile emphasized that the agency:

MUST INCLUDE THE TRACKING ID

on the resubmission before the TrueCall records would be processed and released.

The carrier further states:

Timing Advance records are not readily accessible for production and delivery.

Because of the burden involved, T-Mobile would consider requests only in seven-consecutive-day increments per target telephone number and would formally object to a broader request.

T-Mobile also required that the revised seven-day period remain within the dates authorized by the original legal demand.

What This Document Establishes

This document directly establishes that:

• law enforcement requested historical-location data from T-Mobile's TrueCall system;

• the request was associated with T-Mobile Tracking ID 2883759;

• T-Mobile considered the originally requested timing-advance period too broad for production under its policy;

• T-Mobile required police to narrow the request to no more than seven consecutive days per target;

• a revised warrant/order or resubmission was required before release of the TrueCall records;

• the T-Mobile tracking ID had to be included on that resubmission;

• T-Mobile warned that TrueCall information was not routinely collected everywhere;

• T-Mobile warned that it did not systematically test the reliability or consistency of this location data;

• T-Mobile said it could not certify the accuracy of TrueCall data at the individual account-holder level;

• and T-Mobile limited the type of testimony it would provide regarding how the information was collected, what it meant, and how it should be interpreted.

What This Document Does NOT Establish

This document does not establish that Timing Advance data was ultimately produced.

That is critical.

It shows:

REQUEST → T-MOBILE REQUIRES NARROWING

It does not yet show:

NARROWED REQUEST → ACTUAL TRUECALL RECORDS PRODUCED

We need another document showing the selected seven-day period or the resulting TrueCall/Timing Advance dataset before stating that investigators actually received those records.

It also does not identify, on the face of this notice:

• which seven days police ultimately selected;

• whether police resubmitted the demand;

• when any resubmission occurred;

• whether responsive data still existed at that point;

• or what location results, if any, T-Mobile ultimately produced.

Why This Document Matters

This is highly significant for any later use of T-Mobile Timing Advance evidence.

If the prosecution, police, an analyst, or an expert later presented TrueCall/Timing Advance information as precise historical-location evidence, this carrier document should be examined alongside that presentation.

T-Mobile itself expressly warned:

• it does not use TrueCall data to manage individual accounts;

• it cannot certify the accuracy of the data at the individual account-holder level;

• it does not systematically test the data for reliability or consistency;

• it does not collect the data in every market;

• and it will not testify regarding the details of its collection, substance, or interpretation.

Those are limitations stated by the company that generated the data, not criticisms created later by the defense.

That does not automatically make Timing Advance evidence unusable or inaccurate.

But it does mean the carrier itself placed explicit qualifications on what the data could support.

Relationship to the May 27 Investigation

The underlying T-Mobile production requested records covering:

May 1 through June 1, 2020.

T-Mobile would not provide a month of Timing Advance records under this policy.

Instead, investigators had to choose a maximum seven-consecutive-day period within that larger legally authorized range.

If investigators were specifically focused on Randall Leslie's disappearance on May 27, 2020, a seven-day window surrounding May 27 would be an obvious investigative possibility.

However, this document does not tell us which seven days they actually chose, so that must not be stated as fact.

The next question for the evidence file is therefore extremely specific:

Did Stokes or CPD resubmit Tracking ID 2883759 with a reduced seven-day TrueCall date range, and if so, exactly which seven days were selected?

Potential Discovery Significance

This document also creates a concrete document trail that should exist if the Timing Advance request was completed.

A completed sequence should ordinarily contain something showing:

1. original legal demand;

2. T-Mobile's request to reduce the date range;

3. police resubmission identifying the selected seven days;

4. T-Mobile's actual Timing Advance/TrueCall return, if responsive data existed;

5. any accompanying carrier documentation;

6. any police analysis or mapping based upon those records.

If the case materials contain only this narrowing notice but no reduced-date resubmission or resulting TrueCall data, that would be a materially different record from one in which the full process was completed.

The absence of a document from the current folder alone would not prove it never existed; the rest of the discovery would need to be checked.

Evidence Interpretation Warning

This document creates an important distinction between:

authentication of a record

and

scientific/technical accuracy of the location conclusion drawn from that record.

T-Mobile may certify qualifying Timing Advance records as business records.

But the same carrier expressly says it cannot certify the accuracy of TrueCall data at the account-holder level and does not systematically test its reliability or consistency.

Those are not contradictory statements.

A business record can be authentically generated by a carrier while still carrying limitations regarding how accurately it establishes the physical location of a particular individual.

Catalog Category

Digital Evidence / Cell Phones → T-Mobile Carrier Records → TrueCall / Timing Advance → Carrier Limitations & Date-Range Reduction → Tracking ID 2883759

STATUS: KEEP — HIGH IMPORTANCE

T-Mobile “Unable to Respond” Notice — Text Message Content / Tracking ID 2883759

Document Type: Carrier Legal-Compliance Response / Unable-to-Respond Notice
Carrier: T-Mobile / Metro by T-Mobile
Department: Law Enforcement Relations
T-Mobile Tracking ID: 2883759
Identifier / Subject Number: 561-452-2343
Date: September 2, 2020
File Name: 2883759_UTR.pdf
Document Length: 1 page
File Size: approximately 42 KB

Summary

This one-page document is a formal T-Mobile “Unable to Respond” notice issued in connection with T-Mobile / MetroPCS Tracking ID 2883759.

The notice is dated September 2, 2020 and comes from T-Mobile's Law Enforcement Relations office in Parsippany, New Jersey.

T-Mobile states that it was unable to respond to a portion of the legal demand concerning telephone number:

561-452-2343

The reason given is specific:

T-Mobile / Metro by T-Mobile does not store or maintain text-message content.

That is the entire substantive reason for this particular unable-to-respond notice.

What This Document Establishes

This document directly establishes that:

• law enforcement submitted a legal demand associated with Tracking ID 2883759;

• one of the requested targets was 561-452-2343;

• T-Mobile was asked for information that included text-message content;

• and T-Mobile informed law enforcement that it does not store or maintain text content for that identifier.

Critical Distinction — Content vs. Records of Text Activity

This document does not say:

“No text messages existed.”

It says T-Mobile does not store or maintain the content of text messages.

Those are very different propositions.

A carrier can potentially maintain transactional information showing that SMS/MMS activity occurred—such as dates, times, originating numbers, destination numbers, or network records—without retaining the actual words written inside those messages.

Therefore, this notice should not be used to conclude that there were no texts associated with 561-452-2343.

The correct conclusion is:

T-Mobile could not provide the substantive content of text messages because it did not store or maintain that content.

What This Document Does NOT Establish

This document does not establish:

• that no SMS messages were sent;

• that no SMS messages were received;

• that no MMS messages were sent or received;

• that T-Mobile possessed no metadata concerning text activity;

• that the associated CDR contains no SMS transactions;

• that a handset itself contained no stored messages;

• or that forensic extraction of a physical phone could not recover text content.

It addresses only what T-Mobile's own systems stored or maintained as message content.

Relationship to the Other T-Mobile Records

This notice belongs to the same T-Mobile production as the September 2, 2020 certification for Tracking ID 2883759.

That certification identifies two categories of records T-Mobile actually produced for 561-452-2343 for the May 1 through June 1, 2020 period:

• Call Details With Cell Sites

• Subscriber Information

This UTR notice therefore documents a different category of the legal demand:

TEXT CONTENT — UNAVAILABLE

The production can now be separated more precisely into:

Records T-Mobile says it produced:

• Call Details With Cell Sites

• Subscriber Information

Historical-location request requiring further action:

• TrueCall / Timing Advance — T-Mobile required the date range to be narrowed to seven consecutive days

Information T-Mobile says it could not provide:

• Text-message content

Why This Document Matters

This document matters because it tells us something about the scope of Stokes's legal demand.

The police apparently sought more than subscriber information and call records.

The T-Mobile response shows that the demand also sought text-message content.

That is useful when reconstructing exactly what investigators attempted to obtain from 561-452-2343.

The response also prevents a later misreading of the evidence.

If someone sees no actual text-message conversations in the T-Mobile production, this notice explains why:

the carrier states that it does not store or maintain the content.

That is materially different from saying no messages existed.

Evidence / Discovery Significance

This document gives us another piece of the carrier-production inventory.

For Tracking ID 2883759, the record now shows at least three distinct outcomes:

1. Call Details With Cell Sites — produced

2. Subscriber Information — produced

3. Text-message content — unavailable because T-Mobile did not store or maintain it

And separately, the TrueCall/Timing Advance notice shows that historical-location data required a narrowed seven-day request before production.

That means the T-Mobile production was not simply one generic “phone records” request. Different requested categories received different carrier responses.

Important Investigative Point

If investigators later obtained message content from 561-452-2343, this document would mean that content did not come from T-Mobile's retained text-content records under this request.

It would have to have come from some other source, such as:

• a physical handset extraction;

• another person's phone;

• screenshots;

• cloud/account data;

• another provider;

• or some other evidentiary source.

That source would need to be separately identified.

Catalog Category

Digital Evidence / Cell Phones → T-Mobile Carrier Records → Unable-to-Respond Notices → Text Content → Tracking ID 2883759 / 561-452-2343

STATUS: KEEP — IMPORTANT SCOPE / RETENTION DOCUMENT

T-Mobile Call Detail Records With Cell Sites — 561-452-2343

Document Type: Carrier Call Detail Records / Historical Cell-Site Records
Carrier: T-Mobile US, Inc.
T-Mobile Tracking ID: 2883759
Legal Demand: Search Warrant 20-52161
Requestor: C. M. Stokes
Agency: Chattanooga Police Department — Violent Crimes Bureau / Homicide Unit
Subject MSISDN: 561-452-2343
Requested Period: May 1, 2020 through June 1, 2020
Carrier Production Date: September 2, 2020
File Name: CDR_Mediations_5614522343_8240375.xls
File Size: 4,513,280 bytes / approximately 4.3 MB
Time Standard: UTC — Coordinated Universal Time
Associated Folder: Holland T-Mobile Phone Records
Subscriber Identity: Not yet established from this CDR alone

Summary

This spreadsheet is the substantive T-Mobile Call Detail Record with Cell Site production corresponding to the records authenticated under T-Mobile Tracking ID 2883759.

T-Mobile's header expressly identifies:

Agency: Police
Requestor: C M STOKES
Agent Address: Chattanooga Police Department — Violent Crimes Bureau / Homicide Unit

T-Mobile states that the production was generated on September 2, 2020 in response to Search Warrant 20-52161, dated August 6, 2020, seeking information associated with MSISDN:

5614522343.

T-Mobile also gives an essential warning in the header:

All times are reflected in Coordinated Universal Time (UTC).

That must be preserved when comparing these records to Chattanooga police reports, witness interviews and events stated in local time.

During May 2020, Chattanooga was on Eastern Daylight Time, UTC-4.

Therefore, for example:

22:35 UTC = 6:35 PM EDT.

This becomes particularly important for May 27.

Data Fields Contained in the Spreadsheet

The T-Mobile CDR contains unusually detailed fields, including:

• Date

• Time

• Duration

• Call Type

• Direction

• Calling Number

• Dialed Number

• Called Number

• Destination Number

• IMSI

• IMEI

• Completion Code

• Service Code

• Switch Name

• 1st LTE Site ID

• 1st LTE Sector ID

• 1st LAC

• 1st Cell ID

• 1st Tower Azimuth

• 1st Tower Latitude

• 1st Tower Longitude

• 1st Tower Address

• 1st Tower City

• 1st Tower State

• 1st Tower Zip

• Last LTE Site ID

• Last LTE Sector ID

• Last LAC ID

• Last Cell ID

• Last Tower Azimuth

• Last Tower Latitude

• Last Tower Longitude

• Last Tower Address

• Last Tower City

• Last Tower State

• Last Tower Zip.

This is therefore much more than a billing record.

It is a carrier-generated transaction log containing actual cell-site reference information for individual cellular events.

Device Identifiers

Across the reviewed records, T-Mobile repeatedly identifies:

IMSI: 310260957442469

and:

IMEI: 356074100055430.

Those identifiers should be preserved and compared against:

• subscriber records;

• CPD property records;

• forensic extraction reports;

• handset/device inventories;

• search-warrant descriptions;

• and any other carrier production.

The CDR itself does not establish who physically possessed the handset during each transaction.

Example Cell Site

A large number of transactions use T-Mobile LTE Site ID:

67665

with tower information approximately:

4303C Bonny Oaks Drive
Chattanooga, TN 37416
Latitude approximately 35.0813
Longitude approximately -85.2081

Different sectors associated with this site have different azimuths, including approximately 30° and 150° in the records reviewed.

Other T-Mobile sites appearing in the May 27 records include:

6623 Lee Hwy.
Chattanooga, TN 37421
approximately 35.037996, -85.178671

3713B Cross St (911)
Chattanooga, TN 37411
approximately 35.036633, -85.235275

6021C Cornelison Road
Chattanooga, TN 37411
approximately 35.006128, -85.204378

5093C North Terrace
Chattanooga, TN 37411
approximately 35.005233, -85.224981

1635 E 25th St
Chattanooga, TN 37404
approximately 35.018056, -85.290278.

These are cell-tower/site locations, not the physical coordinates of the handset.

May 27, 2020 — Important Cellular Activity

The May 27 records are extensive.

Because the spreadsheet uses UTC, four hours must be subtracted to compare the records with Chattanooga EDT.

For example:

00:24 UTC May 27 = 8:24 PM EDT on May 26.

This date rollover is critical.

Early in the UTC May 27 records, the handset uses several T-Mobile sites, including:

• 4303C Bonny Oaks Drive;

• 6623 Lee Hwy.;

• 3713B Cross St;

• 6021C Cornelison Road;

• and 5093C North Terrace.

That reflects changes in the cell sites servicing transactions over the course of the records.

It does not establish a precise route by itself, because a cell-site connection identifies the carrier site/sector servicing the transaction rather than GPS coordinates for the handset.

Critical May 27 Evening Window

There is a particularly important portion of this file when the timestamps are converted correctly from UTC to Chattanooga time.

The separately documented shots-fired complaint occurred at approximately 6:35 PM local time on May 27.

That corresponds to approximately:

22:35 UTC on May 27.

The T-Mobile CDR contains activity immediately around that UTC period.

At approximately:

22:29–22:30 UTC
= approximately 6:29–6:30 PM EDT

the carrier records show transactions associated with LTE Site 67665, using the tower at approximately:

4303C Bonny Oaks Drive, Chattanooga.

Additional activity occurs at:

22:31 UTC

with the same site.

There are SMS/network transactions around:

22:33–22:34 UTC

and additional incoming activity shortly thereafter.

At:

22:40:53 UTC
= approximately 6:40:53 PM EDT

T-Mobile records an incoming SMS-related transaction with both the first and last site fields identifying LTE Site 67665, at approximately:

4303C Bonny Oaks Drive, with an azimuth of approximately 30°.

That timing is close enough to the separately documented approximately 6:35 PM shots-fired report that this section deserves a dedicated timeline analysis.

What That Does — and Does Not — Mean

It means the carrier records show the handset associated with 561-452-2343 using cellular service through the T-Mobile site at 4303C Bonny Oaks Drive during transactions close in time to approximately 6:35 PM EDT.

It does not mean:

the handset was physically located at 4303 Bonny Oaks Drive.

The tower address is the location of T-Mobile's network equipment.

The handset could have been elsewhere within the site's service area.

The sector/azimuth information can help narrow the general direction served by the antenna, but it still does not create GPS-level precision.

Late May 27 Movement in the Carrier Records

Later in UTC May 27, the CDR begins showing different network sites.

For example, around 23:24–23:28 UTC—approximately 7:24–7:28 PM EDT—transactions appear through:

6623 Lee Hwy.

Shortly afterward, records again show 4303C Bonny Oaks Drive.

By approximately:

23:35 UTC
= approximately 7:35 PM EDT

a transaction appears through:

5093C North Terrace.

Near:

23:54–23:55 UTC
= approximately 7:54–7:55 PM EDT

transactions appear through:

6021C Cornelison Road.

This shows changes in the network sites servicing the device over the relevant period.

Again, these should be treated as carrier-site associations, not exact handset positions.

Text-Message Activity

The CDR also contains numerous records labeled:

SMSC

and some records labeled:

mSTerminatingSMSinMSC

Those demonstrate carrier network transactions associated with SMS activity.

For some of those transactions, T-Mobile provides cell-site information.

For example, on May 27 at 22:40:53 UTC, the incoming SMS transaction includes both first and last cell-site data identifying the Bonny Oaks tower.

This is consistent with the separate T-Mobile UTR notice we reviewed.

T-Mobile said it does not store the content of text messages.

But this CDR demonstrates that T-Mobile did retain certain transactional/network records showing SMS activity.

That is the exact distinction we identified earlier:

message content unavailable ≠ no record that messaging occurred.

What This Document Establishes

This spreadsheet directly establishes that:

• T-Mobile responded to Search Warrant 20-52161;

• C. M. Stokes was the requesting investigator;

• the production concerns MSISDN 561-452-2343;

• T-Mobile produced records on September 2, 2020;

• the call records use UTC;

• the records contain incoming and outgoing call transactions;

• they contain SMS/network transactions;

• they identify IMSI 310260957442469;

• they repeatedly identify IMEI 356074100055430;

• they contain LTE site and sector identifiers;

• they contain tower azimuths;

• they contain carrier-provided latitude and longitude;

• and they contain street addresses for T-Mobile cell sites.

Why This Document Matters

This is one of the strongest raw cellular-evidence files located so far because T-Mobile does not require us to translate an unexplained tower number using a separate lookup spreadsheet.

The individual transaction records themselves frequently identify:

transaction → timestamp → site → sector → azimuth → tower coordinates → tower address.

That means a detailed May 27 carrier timeline can be constructed directly from this source.

It can then be compared against:

• the shots-fired report;

• witness accounts;

• 4088 Teakwood;

• vehicle movements;

• statements regarding Randall Leslie's location;

• Holland's Sprint records;

• Brown's phone records;

• surveillance;

• and other contemporaneous evidence.

Major Caveat — Whose Number Is This?

This file is stored in folders labeled as Holland T-Mobile records, but the raw CDR itself identifies the MSISDN, not the subscriber's name.

Therefore, we should not yet say that 561-452-2343 was registered to Donyell Holland solely because this file sits in his case folder.

The T-Mobile subscriber spreadsheet:

SUB_AmdocsTibco_5614522343_8240376.xls

is the document that should resolve the carrier's actual subscriber information.

Until that is reviewed, the careful wording is:

“the handset/account associated with T-Mobile MSISDN 561-452-2343.”

Important Comparison With Sprint

The Sprint CDR associated with 423-508-7552 had critical May 27 entries where the 1ST CELL and LAST CELL fields were zero.

This T-Mobile file is different.

For 561-452-2343, T-Mobile provides numerous May 27 transactions containing actual tower locations, addresses and sectors.

Therefore this T-Mobile number has a much richer location trail during the critical date than the ordinary Sprint CDR did.

Catalog Category

Digital Evidence / Cell Phones → T-Mobile Carrier Records → Call Detail Records With Cell Sites → Tracking ID 2883759 → MSISDN 561-452-2343

STATUS: KEEP — HIGH IMPORTANCE

T-Mobile Technical Guide — Interpreting Call Detail Records

Document Type: Carrier Technical Reference / Call-Detail-Record Interpretation Guide
Carrier: T-Mobile US, Inc.
Department: Legal Affairs — Law Enforcement Relations
Title: Interpreting Call Detail Records
Version Shown: v. 170711
File Name: Interpreting Call Detail Records - 02252020.pdf
Associated Production: T-Mobile Tracking ID 2883759 / 561-452-2343
Purpose: Defines the fields and limitations in T-Mobile CDR productions

Summary

This document is T-Mobile's own technical guide explaining how law enforcement should interpret carrier Call Detail Records (CDRs).

T-Mobile explains that its CDR response can contain records with or without location information and that its standard production is an Excel file containing multiple columns.

The carrier describes the report as a combined record of calls and messages and explains that some fields appear only when location information is included.

T-Mobile also expressly states:

T-Mobile does not retain the content of text messages.

This technical guide therefore confirms the distinction already shown in the separate T-Mobile “Unable to Respond” notice: transactional records concerning messaging may exist even though the substantive words contained in those messages are not retained by T-Mobile.

Roaming Limitation

T-Mobile states:

Calls made while roaming do not appear on this report.

This is important.

It means this CDR should not automatically be treated as a complete record of every call involving the handset during the requested period.

If the handset made or received a call while roaming, T-Mobile warns that the transaction may not appear in this particular report.

Therefore:

absence from the CDR does not necessarily prove that no call occurred.

SMS / Messaging Retention

T-Mobile states that, as of February 2020, it retained metadata for certain kinds of 4G/LTE-based messaging—including SMSc and RCS—for approximately 22 months.

The carrier states that if the requested records are older than 22 months at the time of production, some such messages might no longer be represented.

T-Mobile separately states that it retains details of network-originated voice transactions for 24 months.

The Holland-related T-Mobile production was generated in September 2020 for May 2020 records, so those records were well within the retention periods described in this technical guide.

Voicemail Indicators

T-Mobile provides two specific voicemail interpretations:

Outgoing calls to 805-637-7249

indicate incoming calls that were forwarded to the voicemail system.

And:

Outgoing calls to 805-637-7243 / 805-MESSAGE

indicate voicemail retrieval.

Those numbers should therefore not automatically be interpreted as ordinary personal calls if they appear in the CDR.

UTC — Critical Time Warning

T-Mobile expressly warns that its CDR systems natively use Coordinated Universal Time (UTC).

By default, one T-Mobile CDR “day” runs:

00:00:01 through 23:59:59 UTC.

T-Mobile warns that this may not match the calendar date intended by investigators in their local time zone.

The carrier further states that it cannot convert the displayed records into the local time of the handset and tells law enforcement to account for UTC when requesting or analyzing records.

This confirms that the T-Mobile records for 561-452-2343 must be converted from UTC before comparison to Chattanooga events.

For May 2020 in Chattanooga:

UTC minus four hours = Eastern Daylight Time.

That conversion is essential when comparing the records to the May 27 timeline.

Call Types

T-Mobile defines several important call types.

Examples include:

mSOriginating — outgoing voice call
mSTerminating — incoming voice call
mSOriginatingSMSinMSC — outgoing SMS
mSTerminatingSMSinMSC — incoming SMS
moc — mobile originating call
mtc — mobile terminating call
SMSc — text-message transaction
RCS-IMChat — rich-content message, multimedia and text.

This gives us the carrier's own definitions rather than requiring interpretation from the abbreviations.

Important SMS Location Limitation

T-Mobile states that:

Cell-site location is not available for Call Types SMSc and RCS-IMChat.

That is important when reviewing rows that show text activity but blank location fields.

Blank tower information on an SMSc row does not necessarily mean T-Mobile failed to obtain the location.

The carrier's own guide says location information is not available for that call type.

However, some other SMS-related call types—such as mSTerminatingSMSinMSC—can contain site information, as we saw in the May 27 CDR.

Calling, Dialed, Called, and Destination Numbers

T-Mobile distinguishes among:

• Calling Number — number initiating the call;

• Dialed Number — digits entered;

• Called Number — number receiving the call;

• Destination Number — final network destination.

The destination number can differ from the number dialed when the network applies translation, forwarding, voicemail routing, or another network function.

Therefore, apparently different numbers in one transaction do not automatically establish calls among multiple human participants.

IMSI and IMEI

T-Mobile defines:

IMSI as the International Mobile Subscriber Identity associated with the target number, when present.

IMEI as the International Mobile Equipment Identity associated with the target number, when present.

Those definitions confirm the meaning of the identifiers found repeatedly in the 561-452-2343 CDR.

Completion Code

T-Mobile defines completion status including:

Completed Successfully

and:

Abnormal Completion

Importantly, T-Mobile warns that an abnormal-completion transaction can appear in this report even though it may or may not appear on the customer's bill.

Therefore, “Abnormal Completion” should not automatically be described as a successfully completed conversation.

It indicates a network transaction that did not complete normally.

Service Codes

T-Mobile also provides meanings for carrier service codes, including:

• 11 — calling-line identification presentation

• 12 — calling-line identification restriction

• 13 — connected-line ID presentation

• 20 — all call-forwarding services

• 21 — call forwarding unconditional

• 28 — conditional call forwarding

• 29 — call forwarding when subscriber busy

• 2A — call forwarding on no reply

• 2B — call forwarding when unreachable

• 31 — explicit call transfer

• 41 — call waiting

• 42 — call hold

• 51 — multiparty call.

These service codes explain why some T-Mobile CDR rows appear to contain unusual paired or forwarded call transactions.

CRITICAL — Switch Name Is NOT Location

T-Mobile expressly defines Switch Name as:

the name of the network switch used to deliver the call to the target number.

T-Mobile then gives an explicit warning:

“This is NOT an indication of the location of the device.”

This is extremely important.

Values such as:

• ATTAS201

• DATAS010

• ORTAS201

• NVTAS009

• and similar switch identifiers

must not be used to claim that the handset was physically located wherever that switch is named or situated.

Only the actual cell-site fields should be used for tower-location analysis.

LTE Site ID

T-Mobile defines 1st LTE Site ID as the:

eNodeB ID value in decimal

and states that this field appears only when the transaction occurred over LTE.

The corresponding 1st LTE Sector ID identifies the first sector used at that LTE site.

The same applies to the Last LTE Site ID and Last LTE Sector ID fields.

LAC and Cell ID

T-Mobile explains that LAC and traditional Cell ID fields are generally associated with non-LTE transactions.

For an LTE call, the LTE Site ID / Sector ID fields are used instead.

This explains why some rows in the CDR have LTE Site ID information while LAC or Cell ID fields remain blank.

Tower Latitude and Longitude

T-Mobile defines:

1st Tower LAT — latitude of the first cell tower used.

1st Tower LONG — longitude of the first cell tower used.

The corresponding Last Tower fields identify the last servicing tower used during the transaction when available.

This confirms an important point:

The latitude/longitude values in the CDR are the coordinates of the tower—not the coordinates of the handset.

Tower Address

Likewise, T-Mobile defines:

1st Tower Address

as the street address of the first serving tower, when available.

Therefore, when the CDR says:

4303C Bonny Oaks Drive

that is the address of the serving T-Mobile tower, not a statement that the phone itself was physically located at 4303C Bonny Oaks Drive.

That distinction must be maintained in every map, timeline, motion, report, or public-site description.

CRITICAL — What Azimuth Means

T-Mobile gives a detailed explanation of tower azimuth.

The carrier states that the listed azimuth represents the:

center compass-degree facing of the identified tower sector.

T-Mobile explains that a typical tower's coverage is roughly circular and frequently divided into three sectors of approximately:

120 degrees each.

North is:

0°

South is:

180°.

But T-Mobile warns that tower sectors are not necessarily aligned beginning at zero degrees.

Example From T-Mobile

T-Mobile gives this example:

If a sector has an azimuth of:

90°

then the center of that sector points toward 90 degrees.

Because a typical sector covers roughly 120 degrees, its approximate coverage would extend about:

60 degrees on either side

or approximately:

30° through 150°.

That means an azimuth is not a narrow straight line from the tower to the phone.

It identifies the general directional sector that serviced the transaction.

Application to the May 27 CDR

This technical guide substantially strengthens our interpretation of the May 27 records.

For example, the T-Mobile CDR repeatedly identifies the Bonny Oaks serving site with azimuths such as:

30°

and:

150°.

Under T-Mobile's own explanation:

an azimuth of 30° would roughly represent a 120-degree sector centered at 30°, approximately extending 60 degrees to either side.

Likewise, an azimuth of 150° represents a different general directional sector around the same tower.

Therefore, we can legitimately use the CDR to say:

the handset's transaction was serviced by a particular T-Mobile tower and directional sector.

But we cannot legitimately say:

the handset was located exactly on the azimuth line

or:

the handset was at the tower address.

Why This Document Matters

This guide is essential because it prevents both under-reading and over-reading the CDR.

It tells us which fields can legitimately support location analysis and which cannot.

Specifically:

Can support tower analysis:

• LTE Site ID

• LTE Sector ID

• tower azimuth

• tower latitude

• tower longitude

• tower address

Cannot be treated as handset location:

• switch name

May lack location by design:

• SMSc

• RCS-IMChat

Must be time-converted:

• every T-Mobile timestamp, because the carrier records are in UTC.

Very Important Evidentiary Distinction

This document also establishes that T-Mobile's ordinary CDR location data and TrueCall / Timing Advance data are different things.

The CDR already contains:

• serving tower;

• sector;

• azimuth;

• coordinates;

• address.

The separate Timing Advance/TrueCall process could provide another kind of historical-location information, but T-Mobile placed substantial limitations on that system in the separate notice.

Therefore, the existence of CDR tower/sector information does not mean these records are themselves TrueCall records.

The two evidence types should remain separately identified.

What This Document Establishes

This technical guide directly establishes the carrier's intended interpretation of the T-Mobile CDR fields.

Most importantly, T-Mobile itself states that:

• CDR timestamps are UTC;

• calls while roaming are not represented in the report;

• T-Mobile does not retain text-message content;

• SMSc and RCS-IMChat do not provide cell-site location;

• Switch Name does not establish device location;

• LTE Site ID identifies the eNodeB;

• LTE Sector ID identifies the serving sector;

• tower latitude/longitude are the coordinates of the serving tower;

• tower address is the address of the serving tower;

• tower azimuth is the center compass direction of the servicing sector;

• and sector coverage is generally much broader than a single compass line.

Catalog Category

Digital Evidence / Cell Phones → T-Mobile Carrier Records → Technical Reference Materials → CDR Interpretation Guide → Tracking ID 2883759

STATUS: KEEP — HIGH IMPORTANCE / REQUIRED FOR INTERPRETING T-MOBILE CDR

T-Mobile Technical Guide — Interpreting Call Detail Records

Document Type: Carrier Technical Reference / CDR Interpretation Guide
Carrier: T-Mobile US, Inc.
Department: Legal Affairs — Law Enforcement Relations
Title: Interpreting Call Detail Records
File Name: Interpreting Call Detail Records - 02252020.pdf
Associated Production: T-Mobile Tracking ID 2883759 / MSISDN 561-452-2343
Purpose: Explains how T-Mobile call-detail-record fields should be interpreted and identifies important limitations in the carrier data