Link Analysis & Graphing

Once selectors multiply, a graph makes hidden connections obvious. Model the investigation as entities (nodes) and relationships (edges).

Model

• Nodes — each selector/entity: person, username, email, phone, domain, IP, wallet, company, address, device.
• Edges — the relationship and its evidence: owns, registered, posted-from, employed-by, same-photo-as, transacted-with. Label edges with source and confidence.

Tools