Overview
The Communications Visualization Tool gives a consolidated view of all communication events for the case. This allows an analyst to quickly view communications data such as:
- The most commonly used accounts
- Communications within a specific time frame
Usage
The Communications Visualization Tool is loaded through the Tools->Communications menu item.
From the left hand column, you can choose which devices to display, which types of data to display, and optionally select a time range. After any changes to the filters, use the Apply button to update the tables.
The middle column displays each account, its device and type, and the number of associated messages (emails, call logs, etc.). By default it will be sorted in descending order of frequency.
Selecting an account in the middle column will bring up the messages for that account in the right hand column. Here data about each message is displayed in the top section, and the messages itself can be seen in the bottom section (if applicable).
The middle column and the right hand column both have a UI Quick Search feature which can be used to quickly find a visible item in their section's table.
Visualization
The Visualize tab in the middle panel will show a graph of one or more accounts selected in the Browse tab.
To start, right click the first account you want to view.
There are two options, which are equivalent when no accounts have previously been selected:
- Add Selected Account to Visualization - Adds this account and its connections to the graph
- Visualize Only Selected Account - Clears the graph and only displays the connections for this account
After selecting either option, the middle tab will switch to the Visualize view and the graph will be displayed.
The options at the top allow you to clear the graph, try different graph layouts, and resize the graph. The nodes in the graph can be dragged around and nodes and edges can be selected to display their messages or relationships in the right side tab. For example, in the image below the link between two email addresses has been selected so the Messages viewer is displaying the single email between those two email addresses.
