Guide
Link analysis 101: entities, links, and why graphs beat tables
What link analysis is, the two building blocks every board is made of, and why a graph shows in seconds what a spreadsheet hides.
Link analysis is a simple idea: instead of looking at records one by one, you draw the things in a case and the connections between them, and you look at the picture. Investigators in fraud, compliance, law enforcement and journalism have used it for decades, first on paper and corkboards, then in software.
This post covers the basics. No prior experience needed.
Two building blocks
Every link-analysis board is made of two things.
Entities are the things in your case: a person, a company, a bank account, a phone number, an address, a vehicle, an event. Each entity has a type and some attributes. A person might have a name and a date of birth; a bank account has a bank and an account number.
Links are the relationships between entities: owns, works for, called, transferred to, registered at. Links can have attributes too. A transfer has an amount and a date; a phone call has a period.
That's it. A board with ten people and twenty links is already a model of a case.
Why a graph beats a table
Imagine a spreadsheet of 300 bank transfers. Each row is clear: from, to, amount, date. But the questions that matter aren't about one row:
- Which accounts receive money from several sources?
- Is there a person who connects two groups that otherwise never touch?
- Do the transfers form a cycle that brings the money back?
In a table, you answer these with filters, pivot tables and a lot of patience. In a graph, you often answer them by looking. Accounts that receive from many sources become hubs. A person bridging two groups sits right between two clusters. A cycle is a loop you can see.
The graph doesn't replace the evidence. It shows you where to look.
Layouts: the same data, different questions
The same board can be arranged in different ways, and each one answers a different question.
| Layout | The question it helps with |
|---|---|
| Force | What are the groups, and who's at the center? |
| Tree | Who owns or controls whom? |
| Radial | What's around this one person or company? |
| Temporal | In what order did things happen? |
| Swimlane | What did each person or account do over time? |
A good habit: start with Force for a first look, then switch to the layout that matches your question.
Patterns worth knowing
A few shapes come up again and again in investigations:
- Hubs: one entity with many links, like a shell company receiving from many accounts.
- Bridges: an entity that connects two groups, often an intermediary.
- Chains: money or ownership passing through several layers before reaching its destination.
- Repeats: the same address, phone or document showing up on entities that shouldn't share it.
Once you know these shapes, you start seeing them on every board.
Try it
The fastest way to learn is to look at a case. When you first open Minotrace, you get a sample investigation, Operation High Tide. Try the Force layout, then Temporal, and see what each one tells you. The guide covers the rest in five minutes.
Questions, or a pattern you'd like Minotrace to find for you? Tell us.
