Link data in graphs, timelines, and maps to save time and accelerate investigations

Link analysis capabilities continue to grow in importance in a great many investigations, from homicide and sexual assault to property and pattern crimes. Read (and watch!) on — and at the end of the post, download our white paper — to learn how UFED Link Analysis can help you save time and effort in finding leads, establishing patterns, and maximizing the insights available for your investigations.

Construct case timelines from multiple mobile devices

Timelines are one of the most important elements of any investigation. Retrace a victim’s or suspect’s steps through the last hours, days, weeks or even months before an incident. Identify a subject’s patterns of behavior: the days and times s/he regularly visits or calls family members, does business, runs errands, etc. These patterns, as well as deviations from them, can be important in small or large ways.

Learn more about how to quickly visualize timelines in UFED Link Analysis in our video:

Import additional data sources for context

One of UFED Link Analysis’ most important features is the ability to import data from other sources; notably, carrier call detail records (CDRs), which can show the towers to which a suspect or victim device connected over a period of time. This can help establish both travel activity and stationary locations. CDRs can also reveal incoming and outgoing calls and, in some cases, text messages (depending on how long they retain the data).

Watch to learn more about pre-set formats and other features that make CDRs easy to import and analyze alongside device data:

Establish suspects’ and victims’ location behavior

Along with timelines, the maps within UFED Link Analysis can be a good way to narrow down a list of potential leads and establish subjects’ normal and abnormal patterns of behavior. Plot geolocation data from wifi access points, cellular towers, GPS apps, images and video to show two or more suspects in the same location at the same time. You can also do the same to show a suspect’s connection to a victim – or exonerate a suspect accused of wrongdoing.

Learn more about how Map View works in our video:

UFED Link Analysis’ versatility only starts with these features. Download our white paper for additional details about putting it to work for your investigations!



New in UFED Link Analysis: Call detail records, more information management

Since releasing UFED Link Analysis last April, we’ve received many requests from customers for the ability to import more data sources than just UFED extractions. UFED Link Analysis 2.0 gives you that capability, and more.

Multiple data formats

As sales engineer Ronen Engler explained in a recent webinar, call detail records can be an important source of additional data when a subject has another device you don’t have access to. As Ronen explains, you can add the records to the link analysis graph in the same way you would another device:

XML files can also be imported into UFED Link Analysis 2.0.

Ronen’s presentation highlights two other new features:

  • UFED Link Analysis already contains some carrier pre-sets, including AT&T, T-Mobile, Sprint and others. However, you can also map your own pre-sets for Microsoft® Excel® and comma or tab delimited files. UFED Link Analysis will automatically detect and identify recurrent pre-sets after that point.
  • Merge multiple entities. Suspects/victims may use more than one device, and have different details about their contacts in each one; call detail records may duplicate device call and text message logs. UFED Link Analysis allows you to easily merge the multiple entities to become a single entity with all the information from all sources. (Of course, you can also split merged entities. Any newly added information can be assigned to one of the entities as part of the split function.)

Other new features: watch list; more information per subject and entity

UFED Link Analysis 2.0 brings the popular watch list feature, which lets you automatically highlight keywords relevant to your investigation. Define a list of keywords relevant to a case category – say, narcotics, vice or case-specific key names and words – then activate the watch list on open reports. Color code each watch list based on its importance; filter the data it turns up. You can also share the watch list with other authorized personnel by using the export and import feature.

Person information now contains additional data types available from the UFDR file including images, videos, calendar events, notes and passwords. In addition, use the new Edit Entity function to manually add new information, including custom fields, to entities found on the device, including pictures, personal and contact details.

UFED Link Analysis is valuable on a wide range of cases. Link multiple suspects, suspects and victims, and other persons of interest in a wide range of cases. For more information, and to make an inquiry, visit our product page.