For the Cenotaph case, I believe that this was through the suspect's smart phone. Early in the morning when the vandalism occurred there would hardly be anyone at the Cenotaph. As such, the police simply need to check with the telcos on the smart phone signals in that precise (exact) location. Even when a person has left a place hours earlier, the telcos have a record of smart phone signals emitted at that precise location. Trace signals remain in telcos records almost indefinitely.