How would you find such cells from a planning tool and from a drive test tool?

Ignoring low signal conditions, if the best cell RSCP is greater than say -85dBm and there are cells not in the active set but are strong enough to be in the active set then they are candidate for pilot polluters. Looking at cells that have a high noise rise, high amount of traffic compared to surrounding cells, may also indicate a pilot polluter. Areas with high Signal strength for the (Active Set Size + 1) best pilot (like the 4th best pilot if AS size is 3). In DTT, areas with poor Ec/Io but good RSCP, in the monitored set contains a cell with a good Ec/Io but cannot enter the AS because it is full. Areas where scanner shows a strong signal for a far away cell.