Ok here it goes:
In this first case the call was released from the remote side:
There is an incoming data from the switch at first place, 
[code]
-AP[23]->-472 @21:03:02.3000
-Ap[23]-<-472 @21:03:02.3790
[b]@21:03:07.847 DataFromSwitch 96 bytes[/b]
0000-000f: a1 5e 02 02 3e 1b 02 01-15 30 55 55 04 01 17 88 |.^..>....0UU....|
0010-001f: 01 a0 24 a2 22 30 20 6b-0a 82 02 23 48 83 04 01 |..$."0 k...#H...|
0020-002f: d1 01 04 63 0c 82 0a 30-39 39 33 35 31 34 32 33 |...c...099351423|
0030-003f: 33 4e 01 03 0a 01 30 7e-27 a0 0f 17 0d 30 38 31 |3N....0~'....081|
0040-004f: 31 31 37 32 31 30 39 31-30 5a a1 14 30 12 06 06 |117210910Z..0...|
0050-005f: 2b 0c 89 36 84 09 04 08-98 23 22 49 48 23 01 00 |+..6.....#"IH#..|
11/17/08@21:03:07.847 RECEIVED: 96 bytes
aPDU-rose invoke { -- SEQUENCE --
  invokeID 15899,
  operationValue 21,
  argument { -- SEQUENCE --
    crossRefIdentifier '01178801'H  -- "..ˆ." --,
    eventSpecificInfo callEvent connectionClearedEvent { -- SEQUENCE --
      droppedConnection { -- SEQUENCE --
        call '2348'H  -- "#H" --,
        device dynamicID '01d10104'H  -- "...." --
      },
      releasingDevice deviceIdentifier implicitPublic '30393933353134323333'H  -- "0993514233" --,
      localConnectionInfo 3,
      cause 48
    },
    extensions { -- SEQUENCE --
      security { -- SEQUENCE --
        timeStamp '3038313131373231303931305a'H  -- "081117210910Z" --
      },
      privateData { -- SEQUENCE/SET OF --
        privateData { -- SEQUENCE --
          manufacturer {1 3 12 1206 521},
          '9823224948230100'H  -- "˜#"IH#.." --
        }
      }
    }
  }
}
[b]cstaSwitchingEventDecode: ConnectionCleared event in progress[/b]
+++ Evt::ConnectionCleared +++
  *** Transaction Info:
    Type/Oper. : 1 - 3 <Event : ConnectionCleared>
    crossRef   : 1178801
    ConnId[0]  : (2348-1d1)-<(Trunk)>
    LocalDev[0]: 0993514233 (Public)
    Cause      : 48 <NormalClearing>
    LocalInfo  : 3 <Connected>
    TimeStamp  : <081117210910Z>
    *** PrivateList has 1 elements:
      PData : Global CallID : 9823224948230100
  refDev <597061> (cref = '1178801')
  normal release on <0993514233>
  Party::Release: for <2348:2348:0993514233/established/Ok> with cause (NormalClearing[48])
  Party::commit::deleted[1]: for <2348:2348:0993514233/released> with cause/rel (0:0)
--- Evt::ConnectionCleared ---
link (link-tcp) S->H: (0[4 / 0] requests pending)
[b]@21:03:07.972 DataFromSwitch 92 bytes[/b]
0000-000f: a1 5a 02 02 3e 1d 02 01-15 30 51 55 04 01 17 88 |.Z..>....0QU....|
0010-001f: 01 a0 20 a2 1e 30 1c 6b-0a 82 02 23 48 83 04 05 |.. ..0.k...#H...|
0020-002f: 0e 01 00 63 08 84 06 35-39 37 30 36 31 4e 01 00 |...c...597061N..|
0030-003f: 0a 01 30 7e 27 a0 0f 17-0d 30 38 31 31 31 37 32 |..0~'....0811172|
0040-004f: 31 30 39 31 30 5a a1 14-30 12 06 06 2b 0c 89 36 |10910Z..0...+..6|
0050-005b: 84 09 04 08 98 23 22 49-48 23 01 00             |.....#"IH#..    |
11/17/08@21:03:07.972 RECEIVED: 92 bytes
aPDU-rose invoke { -- SEQUENCE --
  invokeID 15901,
  operationValue 21,
  argument { -- SEQUENCE --
    crossRefIdentifier '01178801'H  -- "..ˆ." --,
    eventSpecificInfo callEvent connectionClearedEvent { -- SEQUENCE --
      droppedConnection { -- SEQUENCE --
        call '2348'H  -- "#H" --,
        device dynamicID '050e0100'H  -- "...." --
      },
      releasingDevice deviceIdentifier implicitPrivate '353937303631'H  -- "597061" --,
      localConnectionInfo 0,
      cause 48
    },
    extensions { -- SEQUENCE --
      security { -- SEQUENCE --
        timeStamp '3038313131373231303931305a'H  -- "081117210910Z" --
      },
      privateData { -- SEQUENCE/SET OF --
        privateData { -- SEQUENCE --
          manufacturer {1 3 12 1206 521},
          '9823224948230100'H  -- "˜#"IH#.." --
        }
      }
    }
  }
}
cstaSwitchingEventDecode: ConnectionCleared event in progress
+++ Evt::ConnectionCleared +++
  *** Transaction Info:
    Type/Oper. : 1 - 3 <Event : ConnectionCleared>
    crossRef   : 1178801
    ConnId[0]  : (2348-50e)-<(Unknown)>
    LocalDev[0]: 597061 (Private)
    Cause      : 48 <NormalClearing>
    TimeStamp  : <081117210910Z>
    *** PrivateList has 1 elements:
      PData : Global CallID : 9823224948230100
  refDev <597061> (cref = '1178801')
  normal release on <597061>
  PartyDN::Release: for <2348:2348:5061/established/Ok> with cause (NormalClearing[48])
  PartyDN::commit::deleted[1]: for <2348:2348:5061/released> with cause/rel (0:0)
[b]@21:03:07.9720 [0] 7.5.001.05 distribute_event: message EventReleased[/b]
	AttributeEventSequenceNumber	0000000000000284
	AttributeTimeinuSecs	972000
	AttributeTimeinSecs	1226973787 (21:03:07)
	AttributeThisDN	'5061'
	AttributeExtensions	[82] 00 03 00 00..
		'GCTI_SUB_THIS_DN'	'597061'
		'GCTI_BUSINESS_CALL'	0
		'GCTI_GLOB_CID'	bin: 98 23 22 49.. (len=8)
	AttributeNetworkCallID	9823224948230100
	AttributeCustomerID	'Resources'
	AttributeDNIS	'0993514233'
	AttributeUserData	[2] 00 00..
	AttributeCallUUID	'40H4N2L9911EFCVCE2RARN6LN4000001'
	AttributeConnID	007001a1bc12e001
	AttributeCallID	9032
	AttributeCallType	3
	AttributeCallState	0
	AttributeThisTrunk	1294
	AttributeThisDNRole	1
	AttributeAgentID	'597061'
	AttributeOtherTrunk	262609
	AttributeOtherDNRole	2
	AttributeOtherDN	'0993514233'
[b]21:03:07.972 Int 04544 Interaction message "EventReleased" generated[/b]
21:03:07.972 Trc 04542 EventReleased sent to [460] (00000009 Genesys_Desktop_760 192.168.90.45:3179)
21:03:07.972 Trc 04542 EventReleased sent to [472] (0000000a CTIManager 192.168.50.200:4494)
21:03:07.972 Trc 04542 EventReleased sent to [448] (00000008 StatServer 192.168.90.45:3171)
21:03:07.972 Trc 04542 EventReleased sent to [436] (00000007 StatServerURS 192.168.90.45:3168)
21:03:07.972 Trc 04542 EventReleased sent to [424] (00000006 StatServerReporting 192.168.90.45:3167)
21:03:07.972 Trc 04542 EventReleased sent to [412] (00000005 StatServerGAD 192.168.90.45:3166)
21:03:07.972 Trc 20021 Call 007001a1bc12e001 cleared with TReliabilityOk
  PartyDN: <2348:2348:5061> removed, state = (0-4)
  Party: <2348:2348:0993514233> removed, state = (0-4)
@21:03:07.9720 [0] 7.5.001.05 distribute_event: message EventReleased
	AttributeEventSequenceNumber	0000000000000285
	AttributeTimeinuSecs	972000
	AttributeTimeinSecs	1226973787 (21:03:07)
	AttributeCustomerID	'Resources'
	AttributeDNIS	'0993514233'
	AttributeUserData	[2] 00 00..
	AttributeCallUUID	'40H4N2L9911EFCVCE2RARN6LN4000001'
	AttributeConnID	007001a1bc12e001
	AttributeCallID	9032
	AttributeCallType	3
	AttributeThisDN	'SwitchA4400::'
21:03:07.972 Int 04544 Interaction message "EventReleased" generated
21:03:07.972 Trc 04542 EventReleased sent to [448] (00000008 StatServer 192.168.90.45:3171)
21:03:07.972 Trc 04542 EventReleased sent to [436] (00000007 StatServerURS 192.168.90.45:3168)
21:03:07.972 Trc 04542 EventReleased sent to [424] (00000006 StatServerReporting 192.168.90.45:3167)
21:03:07.972 Trc 04542 EventReleased sent to [412] (00000005 StatServerGAD 192.168.90.45:3166)
  TmCall::deleted(1:0): for <3:2348:0> with rel (0)
  Call::~Call: (2348:2348:0:0) deleted
@21:03:07.9720 {tscp.call {destructed} {uuid 40H4N2L9911EFCVCE2RARN6LN4000001} {connection-id 007001a1bc12e001} {call-id 9032}}
@21:03:07.9720 [0] 7.5.001.05 distribute_event: message EventOnHook
	AttributeEventSequenceNumber	0000000000000286
	AttributeCustomerID	'Resources'
	AttributeTimeinuSecs	972000
	AttributeTimeinSecs	1226973787 (21:03:07)
	AttributeAgentID	'597061'
	AttributeThisDN	'5061'
21:03:07.972 Int 04544 Interaction message "EventOnHook" generated
21:03:07.972 Trc 04542 EventOnHook sent to [460] (00000009 Genesys_Desktop_760 192.168.90.45:3179)
21:03:07.972 Trc 04542 EventOnHook sent to [472] (0000000a CTIManager 192.168.50.200:4494)
21:03:07.972 Trc 04542 EventOnHook sent to [448] (00000008 StatServer 192.168.90.45:3171)
21:03:07.972 Trc 04542 EventOnHook sent to [436] (00000007 StatServerURS 192.168.90.45:3168)
21:03:07.972 Trc 04542 EventOnHook sent to [424] (00000006 StatServerReporting 192.168.90.45:3167)
21:03:07.972 Trc 04542 EventOnHook sent to [412] (00000005 StatServerGAD 192.168.90.45:3166)
--- Evt::ConnectionCleared ---
link (link-tcp) S->H: (0[4 / 0] requests pending) 
[/code]
and now compare to this one which was cleared from GAD which starts with a RequestReleaseCall and then sends the request to the link:
[code]
21:04:49.365 Trc 04541 RequestReleaseCall received from [460] (00000009 Genesys_Desktop_760 192.168.90.45:3179)
message RequestReleaseCall
	AttributeConnID	007001a1bc12e002
	AttributeExtensions	[2] 00 00..
	AttributeReferenceID	12
	AttributeReason	[2] 00 00..
	AttributeThisDN	'5061'
21:04:49.365 Int 04543 Interaction message "RequestReleaseCall" received from 460 ("Genesys_Desktop_760")
11/17/08@21:04:49.365 +++ RqHandler::RequestReleaseCall +++
  got message from client <9>
  device <5061> is replaced by <597061>
  [597061/597061]: check device for 'RequestReleaseCall'
  *** Transaction Info:
    Type/Oper. : 5 - 5 <Request : ClearConnection>
    hostRef    : d8
    ConnId[0]  : (2349-50e)-<(Unknown)>
    SubjDev[0] : 597061 (Private)
    LocalDev[0]: 597061 (Unknown)
    userInfo   : 9, 12
@21:04:49.365 DataToSwitch 21 bytes
0000-000f: a1 13 02 02 00 d8 02 01-05 6b 0a 82 02 23 49 83 |.........k...#I.|
0010-0014: 04 05 0e 01 00         -                        |.....           |
invoke { -- SEQUENCE --
  invokeID 216,
  operationValue 5,
  argument callId { -- SEQUENCE --
    call '2349'H  -- "#I" --,
    device dynamicID '050e0100'H  -- "...." --
  }
}
lnk>   	(link_write) link 1(link-tcp), 23 bytes
  H->S 23 bytes send, invoke id 216 (xd8), 0[5] requests pending
--- RqHandler::RequestReleaseCall ---
@21:04:49.412 DataFromSwitch 35 bytes
0000-000f: a2 21 02 02 00 d8 30 1b-02 01 05 7e 16 a1 14 30 |.!....0....~...0|
0010-001f: 12 06 06 2b 0c 89 36 84-09 04 08 0b 24 22 49 49 |...+..6.....$"II|
0020-0022: 23 01 00               -                        |#..             |
11/17/08@21:04:49.412 RECEIVED: 35 bytes
aPDU-rose retResult { -- SEQUENCE --
  invokeID 216,
  { -- SEQUENCE --
    operationValue 5,
    result extensions { -- SEQUENCE --
      privateData { -- SEQUENCE/SET OF --
        privateData { -- SEQUENCE --
          manufacturer {1 3 12 1206 521},
          '0b24224949230100'H  -- " $"II#.." --
        }
      }
    }
  }
}
+++ Resp::ClearConnection +++
  *** Transaction Info:
    Type/Oper. : 2 - 5 <Result : ClearConnection>
    hostRef    : d8
    *** PrivateList has 1 elements:
      PData : Global CallID : 0b24224949230100
  [597061]: event received, for <RequestReleaseCall:9:12:496:1>
  PartyDN[2349:2349:5061]::SetContext: ref <12:496>
--- Resp::ClearConnection ---
link (link-tcp) S->H: (0[5 / 0] requests pending)
@21:04:49.646 DataFromSwitch 92 bytes
0000-000f: a1 5a 02 02 3e 2d 02 01-15 30 51 55 04 01 17 88 |.Z..>-...0QU....|
0010-001f: 01 a0 20 a2 1e 30 1c 6b-0a 82 02 23 49 83 04 05 |.. ..0.k...#I...|
0020-002f: 0e 01 00 63 08 84 06 35-39 37 30 36 31 4e 01 00 |...c...597061N..|
0030-003f: 0a 01 30 7e 27 a0 0f 17-0d 30 38 31 31 31 37 32 |..0~'....0811172|
0040-004f: 31 31 30 35 31 5a a1 14-30 12 06 06 2b 0c 89 36 |11051Z..0...+..6|
0050-005b: 84 09 04 08 0b 24 22 49-49 23 01 00             |.....$"II#..    |
11/17/08@21:04:49.646 RECEIVED: 92 bytes
aPDU-rose invoke { -- SEQUENCE --
  invokeID 15917,
  operationValue 21,
  argument { -- SEQUENCE --
    crossRefIdentifier '01178801'H  -- "..ˆ." --,
    eventSpecificInfo callEvent connectionClearedEvent { -- SEQUENCE --
      droppedConnection { -- SEQUENCE --
        call '2349'H  -- "#I" --,
        device dynamicID '050e0100'H  -- "...." --
      },
      releasingDevice deviceIdentifier implicitPrivate '353937303631'H  -- "597061" --,
      localConnectionInfo 0,
      cause 48
    },
    extensions { -- SEQUENCE --
      security { -- SEQUENCE --
        timeStamp '3038313131373231313035315a'H  -- "081117211051Z" --
      },
      privateData { -- SEQUENCE/SET OF --
        privateData { -- SEQUENCE --
          manufacturer {1 3 12 1206 521},
          '0b24224949230100'H  -- " $"II#.." --
        }
      }
    }
  }
}
cstaSwitchingEventDecode: ConnectionCleared event in progress
+++ Evt::ConnectionCleared +++
  *** Transaction Info:
    Type/Oper. : 1 - 3 <Event : ConnectionCleared>
    crossRef   : 1178801
    ConnId[0]  : (2349-50e)-<(Unknown)>
    LocalDev[0]: 597061 (Private)
    Cause      : 48 <NormalClearing>
    TimeStamp  : <081117211051Z>
    *** PrivateList has 1 elements:
      PData : Global CallID : 0b24224949230100
  refDev <597061> (cref = '1178801')
  normal release on <597061>
  PartyDN::Release: for <2349:2349:5061/established/Ok> with cause (NormalClearing[48])
  PartyDN::commit::deleted[1]: for <2349:2349:5061/released> with cause/rel (0:0)
  TmRequest::RequestReleaseCall::Add2Msg: context (9:12:496) is matched to [EventReleased], keep=0
@21:04:49.6460 [0] 7.5.001.05 distribute_response: message EventReleased
	AttributeEventSequenceNumber	000000000000028b
	AttributeTimeinuSecs	646000
	AttributeTimeinSecs	1226973889 (21:04:49)
	AttributeReason	[2] 00 00..
	AttributeReferenceID	12
	AttributeThisDN	'5061'
	AttributeExtensions	[82] 00 03 00 00..
		'GCTI_SUB_THIS_DN'	'597061'
		'GCTI_BUSINESS_CALL'	0
		'GCTI_GLOB_CID'	bin: 0B 24 22 49.. (len=8)
	AttributeNetworkCallID	0b24224949230100
	AttributeCustomerID	'Resources'
	AttributeDNIS	'0993514233'
	AttributeUserData	[2] 00 00..
	AttributeCallUUID	'40H4N2L9911EFCVCE2RARN6LN4000004'
	AttributeConnID	007001a1bc12e002
	AttributeCallID	9033
	AttributeCallType	3
	AttributeCallState	0
	AttributeThisTrunk	1294
	AttributeThisDNRole	1
	AttributeAgentID	'597061'
	AttributeOtherTrunk	262608
	AttributeOtherDNRole	2
	AttributeOtherDN	'0993514233'
21:04:49.646 Int 04544 Interaction message "EventReleased" generated
21:04:49.646 Trc 04542 EventReleased sent to [460] (00000009 Genesys_Desktop_760 192.168.90.45:3179)
21:04:49.646 Trc 04542 EventReleased sent to [472] (0000000a CTIManager 192.168.50.200:4494)
21:04:49.646 Trc 04542 EventReleased sent to [448] (00000008 StatServer 192.168.90.45:3171)
21:04:49.646 Trc 04542 EventReleased sent to [436] (00000007 StatServerURS 192.168.90.45:3168)
21:04:49.646 Trc 04542 EventReleased sent to [424] (00000006 StatServerReporting 192.168.90.45:3167)
21:04:49.646 Trc 04542 EventReleased sent to [412] (00000005 StatServerGAD 192.168.90.45:3166)
  context is reset
  CallList::Delete: call (3:2349:2) to be deleted
  Party::Release: for <2349:2349:0993514233/established/Ok> with cause (Failed[57])
  Party::commit::deleted[1]: for <2349:2349:0993514233/released> with cause/rel (0:0)
  PartyDN: <2349:2349:5061> removed, state = (0-4)
  Party: <2349:2349:0993514233> removed, state = (0-4)
@21:04:49.6460 [0] 7.5.001.05 distribute_event: message EventOnHook
	AttributeEventSequenceNumber	000000000000028c
	AttributeCustomerID	'Resources'
	AttributeTimeinuSecs	646000
	AttributeTimeinSecs	1226973889 (21:04:49)
	AttributeAgentID	'597061'
	AttributeThisDN	'5061'
21:04:49.646 Int 04544 Interaction message "EventOnHook" generated
21:04:49.646 Trc 04542 EventOnHook sent to [460] (00000009 Genesys_Desktop_760 192.168.90.45:3179)
21:04:49.646 Trc 04542 EventOnHook sent to [472] (0000000a CTIManager 192.168.50.200:4494)
21:04:49.646 Trc 04542 EventOnHook sent to [448] (00000008 StatServer 192.168.90.45:3171)
21:04:49.646 Trc 04542 EventOnHook sent to [436] (00000007 StatServerURS 192.168.90.45:3168)
21:04:49.646 Trc 04542 EventOnHook sent to [424] (00000006 StatServerReporting 192.168.90.45:3167)
21:04:49.646 Trc 04542 EventOnHook sent to [412] (00000005 StatServerGAD 192.168.90.45:3166)
--- Evt::ConnectionCleared ---
link (link-tcp) S->H: (0[4 / 0] requests pending) 
[/code]
It is not perfect and complicated but it has helped me a couple of times, of course, I only do this job when situtation is VEEEEERY urgent to determine who cut the call...
I'm not perfect and any observations are welcome. This is my scenario and can't say if will work if agent hangs up from handset (hardphone) directly.
Hopefully this will satisfy you CTIGem...and René 
