Start with the detective board overview if you need a board structure before analyzing links. The journalism guide applies this work to sources and documents.

Link analysis is an investigative technique for discovering and visualizing connections between people, organizations, locations, events, and other entities. By mapping these relationships visually, investigators can see patterns that are hard to spot in a folder of documents or a table.

What is Link Analysis?

Link analysis examines relationships between entities to discover:

  • Direct connections - Who knows whom? Who worked where?
  • Indirect connections - How are two seemingly unrelated people connected through intermediaries?
  • Patterns - What relationships repeat? What structures emerge?
  • Anomalies - What connections are unexpected or suspicious?
  • Key players - Who sits at the center of the network?

The output is typically a visual network diagram showing entities as nodes and relationships as links (edges) between them.

Who Uses Link Analysis?

Law Enforcement

Criminal investigations use link analysis to map criminal networks, trace communication patterns, connect suspects to crimes, and identify associates.

Financial Investigators

Fraud detection, money laundering investigations, and compliance teams use link analysis to trace transaction flows, identify shell companies, and uncover hidden ownership structures.

Intelligence Analysts

National security and corporate intelligence teams map organizational structures, influence networks, and communication patterns.

Corporate Investigators

Internal investigations, due diligence, and compliance teams map employee relationships, vendor connections, and potential conflicts of interest.

Journalists

Investigative journalists use link analysis to map sources, trace document provenance, and visualize complex stories involving multiple actors.

Consultants and Analysts

Management consultants and business analysts map stakeholder relationships, organizational structures, and influence networks within client organizations.

Link Analysis Techniques

1. Entity Extraction

Pull out the people, organizations, places, events, objects, and communications named in your materials.

2. Relationship Identification

For each pair of entities, check for employment, ownership, family, association, transaction, and location relationships.

3. Network Construction

Build the visual network by:

  • Creating a node for each entity
  • Drawing links between related entities
  • Labeling links with relationship types
  • Adding attributes (confidence level, source, and dates in the notes)

4. Network Analysis

Analyze the network structure to find insights:

  • Degree - Which nodes have the most connections?
  • Clusters - Which nodes group together?
  • Bridges - Which nodes connect different clusters?
  • Paths - How are distant nodes connected?
  • Gaps - Where are connections missing or unclear?

On a hand-built board you read these by eye: count the strings on a card, look for tight groups, and look for the one card that joins two groups. Tools such as Gephi compute them.

Link Analysis Best Practices

Start with a Clear Question

What are you trying to discover? "How is Person A connected to Company B?" is more actionable than "Map everything about this case."

Document Your Sources

Every link in your network should trace back to a source. "Per phone records, 3/15" or "Interview with witness, Exhibit 4." Source documentation is essential for credibility and follow-up.

Mark Confidence Levels

Mark each link:

  • Confirmed - Documentary evidence or direct observation
  • Suspected - A single source or a reasonable inference
  • Uncertain - Speculation or an unverified claim

Include Temporal Information

Relationships change over time. Note when relationships existed, when events occurred, and how the network evolved. Past connections may be as important as current ones.

Look for What's Missing

A missing connection can matter too. Why do these two people never appear together? Why is there no contact during this period?

Iterate and Refine

Link analysis is iterative. As you discover new information, update the network. As patterns emerge, dig deeper.

Common Link Analysis Patterns

Hub and Spoke

One central entity connects to many others, but those others don't connect to each other. Common in hierarchical organizations or when one person is a key intermediary.

Clusters

Groups of tightly connected entities with fewer connections to other groups. May indicate teams or separate operations.

Chains

Linear sequences of connections. Common in transaction flows or communication chains where information or money passes through intermediaries.

Triangles

Three entities all connected to each other. Strong triangles often indicate close relationships or collaboration.

Brokers

Entities that connect otherwise separate clusters. Brokers often have disproportionate influence because they control information flow between groups.

Link Analysis Software

Several categories of tools support link analysis:

Purpose-Built Investigation Tools

  • Redstrings - Visual investigation boards with relationship mapping, local-first privacy
  • i2 Analyst's Notebook - Enterprise investigation platform, expensive
  • Maltego - OSINT-focused, technical learning curve

General Network Visualization

  • Gephi - Open source, computes network metrics, steep to learn
  • yEd - Free graph editor
  • Kumu - Web-based network mapping

Key Features to Look For

  • Easy node and link creation
  • Labels on relationships, so a line means something
  • Entity categorization (people, orgs, places)
  • Search and filter capabilities
  • Privacy (local storage for sensitive investigations)

Why Redstrings for Link Analysis?

Redstrings is built for visual investigation and relationship mapping:

  • Card types - Person, Team, Artifact, Process, Place, Event, Note
  • Labeled strings - Each relationship carries a label, notes, source, and confidence
  • Confidence levels - Mark strings as Confirmed, Suspected, or Uncertain
  • Source tracking - Document where each connection came from
  • Local storage - Boards are files on your machine. Optional AI analysis sends selected board content to Google with your own Gemini key when you run it.
  • Visual investigation board - Zoom to fit shows the whole board on one screen.

Redstrings covers the basics of link analysis without a training course. Add cards, draw strings, label them, and mark confidence.

Download Redstrings free and start your link analysis.