I believe it is possible to obtain a 'tower dump' which could provide details of phones on a particular tower in a particular time frame. I am no expert but have seen it mentioned. Perhaps we have some cell phone experts on the forum who could clarify this for us?
Among the things that they can do from a cell tower (or multiple cell towers) dump is (over a specified period of time):
Determine the globally unique identifier IMSI of every phone that was in contact with that tower(s).
Determine the phone provider for each phone.
Determine the name of the subscriber name and billing address for contract phones.
Determine where and when the phone SIM was activated to allow access to the phone network - for contract and non-contract phones.
Determine all roaming phones.
Determine all phones that had their numbers forwarded to another number.
Determine all phones that were having calls forwarded to them from another number.
Determine the location (approximately) of each of those phones at every instance of contact with the tower.
Determine all phones that were moving, including those that moved into the area, stopped, and started moving again.
Determine all phones that were passing through the area. That is, kept moving along a road/highway without stopping.
Determine all phones connected to the tower but never moved.
Determine the time and location of the phone anytime a phone transmitted/received data, sent/received messages, made/received any calls (even if unanswered) while connected to that tower.
