Graph, search, and paths

Moving around the investigation board, finding entities, and following links.

Orient yourself

  • Open link analysis from the case. You should see nodes (entities) and lines (relationships or co-mentions, depending on your deployment).
  • If the graph looks crowded, use filters or categories when the UI offers them. Many teams start with people or phones only.

Use search to jump to an entity by name, number, or nickname you have seen in the case. Open the entity's detail view to see where it appears in evidence (mentions, files, timestamps when available).

Expand carefully

Expand one connection at a time when you are hunting a specific link. Opening “everything” at once often creates a hairball that is hard to read.

Shortest path

When you have two entities of interest (two people, a person and a phone, and so on), use shortest path if your product exposes it. It suggests a chain of links between them, not proof of conspiracy by itself, but a lead to verify in the underlying recordings and documents.

Some layouts include a sidebar or overview with counts and quick entry points. Use that for triage before you dive into the full graph.

Performance

On very large cases, the board may load in slices or ask you to narrow scope. That is normal. Work the case in chunks rather than forcing the whole graph at once.

Link analysis overview · Flash PD guides