Geo-loc analyses tab

This topic describes the Geo-loc analyses tab on the Analysis results view, which by default is located at the left of the ESPA analysis center screen.

The Geo-loc analyses tab displays a statistical analysis of the geo-location data associated with the phone numbers and license plates you have selected in Sources. On the Geo-loc analyses tab these phone numbers are titled the Target number. The geo-location analysis information can be used to find critical leads and evidence during your investigation, for example it helps you determine:

  • The most frequently visited geographic locations of a person, for example this may be their home, employment location, night-time activity locations, and areas of illegal activities.

  • The location pattern broken down by hour. This information provides you with the persons daily location behavior.

  • Whether or not a person visited a defined target location.
  • Which people were physically close to each other during similar times.

By default the results display all the available columns, for example Frequent location displays all the columns shown in the following graphic but you can select to display only certain columns by selecting the down arrow beside an existing column header, then select Columns.

You can also reorder the listings of the results by selecting the column header you want to order by, then select either Sort Ascending or Sort Descending as shown in the following graphic.

Click to open or close the view. You can also click and drag the view border to change the view size.

Click to expand the view of the Analysis results view so that it displays the total width of the contents of the currently selected tab. If the view is expanded click to restore it to its previous size.

Click to display a list of all the tabs that are currently open on the Analysis results view. This is useful if you have a lot of tabs open as it provides an alternative method to select that tabs rather than locating them by scrolling along them.

Click to export a .csv file of the geo-location analysis results.

For each of the target phone numbers and license plates you selected in Sources, this displays by default the top ten most frequently visited map locations. The map locations are created and named automatically by OSS-ESPA using the format GL<n>. Each of these map locations are an area on the map, the size of which you can define using Bin size on the Advanced options dialog box. The default size is 500m2. Click beside a target phone number or license plate to display the details of the frequent map locations.

You can change the number of results displayed from the default of ten using Items to calculate.

For further information on using this analysis refer to Analyzing the persons most frequent locations.

The following columns are displayed:

  • Target number or License plate / Location: the top level folder displays either the target phone number or the license plate. Then within that the most frequent map locations are listed.
  • Name: this displays the person associated with the target phone or license plate.
  • Total: this displays the total number of geo-location events that occurred which have a latitude and longitude value within that map location. combined voice call and SMS call counts made or received using the sector.

  • Latitude range: this displays the first and last latitudes of the map location.

  • Longitude range: this displays the first and last longitudes of the map location.

  • First event: this displays the first time a geo-location event occurred in the map location. This, along with Last event allows you to investigate the calling pattern using that specific map location. The following are examples of how this data may help your investigation:
    • A map location may be in this most frequently used location list but only because there were many geo-location events in the map location during the time of the crime and outside of that time the map location has no geo-location events.

    • If the last geo-location event from a frequent map location is around the time of the crime, it may indicate that the suspect fled the area or left the area, for example to hide evidence.

    • If a suspect’s first geo-location event from a frequent map location is located near the victim’s home or the victim’s travel location, it may indicate that the suspect has traveled to this location to commit the crime, for example to defraud a victim or to commit murder.

  • Last event: this displays the last time a geo-location event occurred in the map location. This, along with First event allows you to investigate the geo-location event pattern using that specific map location. Refer to the examples in First call on how this data may help your investigation.

 Right click on any item to select:

  • Select all Geo-loc data for this item: this updates the Geo-loc data tab so that only those geo-location events using the frequent map location are displayed as selected in the check-box. The map view is also updated to display the geo-location events.
  • Deselect all Geo-loc data for this item: this updates the Geo-loc data tab so that those geo-location events occurring in the frequent map location are not displayed as selected in the check-box. The map view is also updated so that the geo-location events are not displayed.

For each of the target phone numbers you selected in Sources, this displays a break down of the number of geo-location events by the hour from 00 (00:00 - 00:59) through 23 (23:00 - 23:59). Click beside a target phone number to display each hour. This analysis is designed to help you identify the normal location behavior of the person and to identify any map locations that they visited outside of their normal location behavior. For example, if the person made frequent visit to a map location during the time period 08:00 through 22:00, but there was one instance of a visit at 02:00 it may be that this visit at 02:00 is associated with a crime you are investigating.

For further information on using this analysis refer to Analyzing the persons location patterns.

The following columns are displayed:

  • Target number / Hour: the top level folder displays either the target phone number or the license plate. Then within that a folder for each hour from 00 (00:00 - 00:59) through 23 (23:00 - 23:59). Then within that the top five most frequent map locations. The name of the person associated with the target phone or license plate is also displayed.
  • Total: this displays the total number of geo-location events that occurred within the hour which have a latitude and longitude value within that map location. combined voice call and SMS call counts made or received using the sector.

  • Latitude range: this displays the first and last latitudes of the map location.

  • Longitude range: this displays the first and last longitudes of the map location.

  • First event: this displays the first time a geo-location event occurred during the hour.
  • Last event: this displays the last time a geo-location event occurred during the hour.

Right click on any item to select:

  • Select all Geo-loc data for this item: this updates the Geo-loc data tab so that only those geo-location events using the map location during the selected hour are displayed as selected in the check-box.The map view is also updated to display the geo-location events.
  • Deselect all Geo-loc data for this item: this updates the Geo-loc data tab so that those geo-location events occurring in the map location during the selected hour are not displayed as selected in the check-box. The map view is also updated so that the geo-location events are not displayed.

For the target phone numbers or license plates you selected in Sources, this displays which of them were identified as being at any of the target locations. Click beside the phone number or license plate to display the details of all the target locations they were in. This analysis is designed to help you identify which phone numbers and license plates were at which target locations. The analysis only runs on target locations which have a Location buffer set and an Event start and Event end time set.

For further information on using this analysis refer to Analyzing which target locations persons were at.

The following columns are displayed:

  • Target number or License plate / Location: the top level folder displays either the target phone number or the license plate. Then within that are listed all the target locations they were at based on the geo-location data.
  • Name: for the folder this displays the name of the person associated with the target phone number or the license plate.
  • Total: this displays the total number of geo-location events that occurred at the target location.
  • First event: this displays the first time a geo-location event occurred at the target location.
  • Last event: this displays the last time a geo-location event occurred at the target location.

The analysis list interacts with the map and Geo-loc data tabs so that when you right-click any item you can:

  • Select all Geo-loc data for this item: this updates the Geo-loc data tab so that only those geo-location events associated with the selected person's device at location item are displayed as selected in the check-box. The map view is also updated to display the geo-location events.
  • Deselect all Geo-loc data for this item: this updates the Geo-loc data tab so that those geo-location events associated with the selected person's device at location item are not displayed as selected in the check-box. The map view is also updated so that the geo-location events are not displayed.

In addition if you right-click on any location you can also:

  • Zoom to this item: select to zoom to the latitude and longitude of the selected target location on the map.

For each of the target phone numbers and license plates you selected in Sources, this displays the people identified as being within a specified distance of each other within a specified time interval based on the latitude/longitude and time values of their geo-location events and their CDR data. Click beside the common location details to display the details of all the target phone numbers and license plates that used the included sectors or had geo-location events in the map location during the specified time interval. This analysis is designed to help you identify people who were physically close to each other during similar times. You define the time interval and inclusion distance for this analysis using the Advanced options dialog box.

This analysis requires you to upload cell tower data if you want to include CDR data in the analysis.

For further information on using this analysis refer to Analyzing which persons are in the same location at the same time.

The following columns are displayed:

  • Common location / Target number or License plate: at the folder level this displays the details of the location. The locations are identified as "Location<n>". This may include a number of GL<n> grids and also sectors. Under the folder it lists all the target phone numbers or license plates that used this location during the specified time interval.
  • Time interval/Name: in the folder level row this displays the time interval. Under this it displays the name of the person. Note, you can define the length of the time interval using the Advanced options dialog box.
  • First event: this displays the first time a geo-location event occurred in the map location or a call or SMS was made or received using the included sectors during the specific time interval.
  • Last event: this displays the last time a geo-location event occurred in the map location or a call or SMS was made or received using the included sectors during the specific time interval.
  • Total: if the analysis only includes geo-location events then this displays the total number of those events. If the analysis includes both CDR and geo-location events then this displays the combined voice call and SMS call counts made or received using the included sectors during the specific time interval and the geo-location events that occurred in the location.

The analysis list interacts with the map, Geo-loc data, CDR data and Sector data tabs so that when you right-click any item you can:

  • Select all CDRs for this item: this updates the CDR data and Sector data tables so that only those calls and sectors used by the selected common location-time item are displayed as selected in the check-box. The map view is also updated to only highlight those sectors used during this item.
  • Deselect all CDRs for this item: this updates the CDR data and Sector data tables so that those calls and sectors used by the selected common location-time item are not displayed as selected in the check-box. The map view is also updated so that those sectors used during this item are not highlighted.
  • Select all Geo-loc data for this item: this updates the Geo-loc data tab so that only those geo-location events associated with the selected common location-time item are displayed as selected in the check-box. The map view is also updated to display the geo-location events.
  • Deselect all Geo-loc data for this item: this updates the Geo-loc data tab so that those geo-location events associated with the selected common location-time item are not displayed as selected in the check-box. The map view is also updated so that the geo-location events are not displayed.