Using the people and devices analyses

The People and devices screen allows you to view the frequent contacts analysis, common contacts analysis and a link analysis which provides an easy-to-use interactive graphical representation of the links between the targets and their contacts in your current case, and their links to targets and contacts in other cases.

This topic describes how to run and view the analyses on the People and devices screen which provides a simple method of generating and viewing frequent contacts, common contacts and the link analysis. If required, you can also create IQ packet reports containing the frequent number, common number, social media frequent contact and social media common contacts analyses which are sent to you by email, or are available to download from the Manage case screen, or you can view the analyses on the ESPA analysis center's Call analyses tab.

  1. For the case you want to generate a people and devices analysis for, open the Manage case screen.

    On the main menu click View cases. The screen that opens depends on your setting of View cases. If it is set to:

    • Advanced view, then the Advanced view cases screen opens.
      • If your case is listed on the Favorite & recent cases tab, click the case name to open the Manage case screen.
      • If it is not listed on the Favorite & recent cases tab, then click the Cases tab. Use the search filters to help locate your case. You can also click to open the FILTERS group which allows you to set your own default filter defining what is displayed on this tab, for example you may wish to set it to cases that you created which are currently open.

      For further information refer to Searching for a case.

    • Grid view, then the View cases screen opens.
      • If your case is listed under My recent cases click it to open the Manage case screen.
      • If it is not listed under My recent cases then select your case from the table, using the search filters to help locate it if required. Note, by default the search is set to only display cases that you created; if you are not the original creator but an assignee then ensure you set Case filter to Assigned cases before clicking Search.
    • Tree view, then the View i-cases screen opens.
      • Click at the top-right of the screen to open either the View Cases or Advanced view cases screen and follow the above description.

  2. On the Manage case screen click People and devices.

    The People and devices screen opens.

    If you prefer to use the wizard to manage all your case details then on the Manage case screen, click Go to wizard, click People and devices of interest and then click Add/Edit persons' devices.The People and devices screen opens.

  3. On the People and device analysis tab, ensure the Analysis tab is displayed then click Run analysis. If an analysis has been previously run then the date and time of it is displayed so that you can determine whether or not you want to rerun it to include new data that may have been added to your case or any other cases in your OSS-ESPA account. The analysis is run in the background and you can continue to use the case and the previous analysis until the new one is complete.

    Note that the Run analysis on this tab is coupled with the Run analysis in the Associate settings on the People and devices information tab.

  4. Once the analysis is complete the spinning circle disappears. Click Analysis log to ensure it has completed successfully. Once an analysis has completed successfully then the Process status is displayed as Done, and there should be nothing displayed alongside Process error. If there is an error that you are unable to resolve then contact Gladiator Forensics support.

  5. On the Analysis tab you can view the Frequent contacts tab, Common contacts tab and Link analysis tab.

    The Frequent contacts tab is designed to help you investigate regular contacts. You can then use this information to search for phone numbers in a public record database to determine the phone users names and addresses. This then provides you with additional interview leads, suspects or victims.

    The frequent contacts listed are those based on the files in your current case. In the unexpanded rows, it details the frequent associate's name and number/account, the number of other cases (x-cases) the frequent associate is in, and the number of other case targets (ICW) the frequent associate is in contact with. This row also includes the first and last call, and the number of each event type for your current case.

    Click on the arrow at the start of each row to display the details of the other cases and case targets who the frequent associate number/account was in contact with. These expanded rows provide you with the name and number/account of the ICW case target, a link to open the x-case, and data associated with their events in that x-case.

    In addition, the First call along with the Last call allow you to investigate the communication pattern between the two numbers/accounts. The following are examples of how this data may help your investigation:

    • The number/account may be in this most frequently contacted list but only because there were many communications during the time of the crime and outside of that time there was no contact. Depending on your crime this may indicate they were an accomplice.
    • Anyone who communicates often but stops communicating around the time of a crime, for example a murder or an abduction, is a potential suspect. For example, a boyfriend may call his girlfriend frequently, but if his last call is immediately before the time his girlfriend is murdered then this may indicate that he knew of the murder and therefore he stopped calling her.
    • A new frequently called contact may be a potential suspect. For example, the time of the first call may indicate that a victim just met the contact a few days prior to the crime.

    The Common contacts tab is designed to help you investigate contacts that two or more people have in common. You can then use this information to search for phone numbers in a public record database to determine the phone users names and addresses. This then provides you with additional interview leads, suspects or victims.

    The common contacts listed are those based on the files in your current case. In the unexpanded rows, it details the common associate's name and number/account, the number of other cases (x-cases) the common associate is in and the number of other case targets (ICW) the common associate is in contact with. This row also includes the first and last call, and the number of each event type for your current case.

    Click on the arrow at the start of each row to display the details of the other cases and case targets who the common associate contact was in contact with. These expanded rows provide you with the name and number/account of the ICW case target, a link to open the x-case, and data associated with their events in that x-case.

    In addition, the First call along with Last call also allows you to investigate the communication pattern between the two numbers/accounts. The following are examples of how this data may help your investigation:

    • This data can be used in a similar way to the first and last communications in Frequent contacts, however additionally you can analyze multiple suspects together, or the suspect's and victim's communications pattern with a common contact.
    • If a person is communicating with both the suspect and the victim after the crime to find out the location of the victim it may suggest they are unaware of the crime. You may therefore decide to exclude the person as a suspect.

    • If a person is communicating with the suspect, but has stopped communicating with the victim it may indicate that they knew of the murder and they therefore may be an accomplice. You may therefore decide to include the person as a suspect.

    The Link analysis tab provides you with an interactive graphical representation of the links between the targets and their contacts in your current case, and their links to targets and contacts in other cases. It allows you to:

    • view who the targets and associates are in contact with (ICW) in other cases. Use Show ICW (in contact with) to display the names of the targets and then the case they are in.

    • view the other cases a target or their contact is in. Use Show x-case to display the names of the cases and then the names of the targets they are in contact with.

    • view all the contacts for each target.

    • view the top ten frequent phone and account contacts for each target.

    • view the common phone and account contacts between the case targets.

    • group the contacts' phones by state making it easier to identify other phones of interest.

    • view each person's information. Use the Show person info menu item to display the person's details in a pop-up where you can view and manage their alias names and tags.

    • open linked cases. Use the Open case menu item to open a case's Case management screen.

    • export the graphic as a .png file for use in reports using .

    The following graphic details the tab's features:

    Show contacts: allows you to quickly display the same contact details for all the targets. You can also apply this on a per target basis by right-clicking a target's phone or account node.

    enlarges the link analysis tab so that it uses the full screen making viewing the chart details easier.

    closes the full screen mode.

    zooms in and out of the chart. Note, you can also use the scroll wheel on your mouse to zoom in and out.

    exports the current link analysis as a png file. This may be useful if you want to include it in a report.

    refreshes the chart. This may be required if the graphic is not displaying correctly. Clicking simply refreshes the graphic but does not move any of the nodes.

    allows you to start a new analysis by resetting all the nodes to their original position, including any that you have hidden.

    Chart layout: this menu offers a variety of different methods of viewing the chart allowing you to choose your preferred view.

  6. If you want to filter the data displayed on the tabs click Analysis filters to open a comprehensive set of filters and search strings. The data on all the tabs, that is the Frequent contacts, Common contacts and Link analysis tabs, automatically updates.

    When you select an item in a column of the filter it disables all the other items in that same column, and disables items in other columns that are no longer applicable. For example, if you select a target number and that number has no SMS calls then SMS in the Call type column automatically disables. When a filter is applied to a column is displayed above the column which allows you to clear the column filter. Clear filters allows you to clear the filters applied to all the columns.

    You can also filter for, or to exclude specific associate numbers.

    If you use common filter settings then you can save them as Workspaces by clicking , and edit or delete them by clicking .

  7. You can also download a Microsoft Excel copy of the frequent numbers analysis by clicking at the top of the tab. The file provides a list of all the contact phone numbers, and a number of tabs that allow you to view the data by year/week, weekday and hour. The Associate_Info tab provides more details on any of the frequent numbers which include the associate's name.

    ICW (In Contact With information) is included:

    • ICW Count and ICW columns are included on the Frequent numbers tab of the Excel output, displaying the number of other targets the frequent number was in contact with and the target names respectively.

    • an ICW Detail Info column is included on the Associate_Info tab of the Excel output, which details the case names and the target names.

  8. You may also want to refer to these other OSS-ESPA features that help you investigate who phone numbers are contact with: