Link Analysis: How Investigators Map Connections, with Methods and Tools

Link analysis is a method for finding and showing the connections between people, organizations, places, events, accounts, and objects. Each entity becomes a node, each relationship becomes a labeled link, and the resulting chart shows patterns that a pile of documents or a spreadsheet hides: who sits at the center, who connects two groups, and which link nobody can explain.

Police, intelligence analysts, fraud teams, and journalists all use it. This guide covers the method, how it is used in criminal investigation and intelligence work, and the software available for it. If you need a board before you analyze anything, start with thedetective board overview. Thejournalism guide applies the same work to sources and documents.

What Is Link Analysis?

Link analysis asks questions about relationships instead of about single facts:

• Direct connections - Who knows whom? Who owns what? Who was where?
• Indirect connections - How are two people connected through intermediaries?
• Central players - Which person or company has the most connections?
• Brokers - Who is the only link between two otherwise separate groups?
• Anomalies - Which connection is unexpected, recent, or unexplained?

The output is a link chart, also called an association chart or network diagram. Link analysis is a form of network analysis. The difference is mostly one of practice: an investigator usually builds a link chart by hand from case material, while network analysis in research often computes metrics over large data sets.

Link Analysis in Criminal Investigation

Link analysis is a standard crime analysis technique. In a criminal investigation it turns statements, records, and surveillance into a chart that investigators, supervisors, and prosecutors can read at a glance. These are the analysis types that come up most often:

Association Analysis

Who knows whom. Suspects, victims, witnesses, and associates go on the chart with the relationship on each link: family, employer, co-defendant, shared address. This is the basic link chart, and it is the starting point for the others.

Communication Analysis

Who contacted whom, how often, and when. Call detail records, messages, and email headers show which phones or accounts are in contact, which numbers act as a relay, and how contact changes around the date of an offense.

Financial Flow Analysis

Where money moves. Accounts, companies, and transfers go on the chart to trace funds through intermediaries and shell companies. Fraud and money laundering investigations depend on it.

Event and Timeline Analysis

What happened in which order. Events go on a timeline and link to the people and places involved. A timeline shows gaps, overlaps, and alibis that conflict.

Commodity Flow Analysis

How goods move through a network, for example drugs or stolen property, from source to buyer. The chart shows the roles in the chain: suppliers, couriers, stash locations, and sellers.

For law enforcement, the chart also has to survive scrutiny. Every link needs a source that someone can check, and a suspected link must look different from a confirmed one. A chart that mixes the two can mislead a reader who did not build it.

Link Analysis in Intelligence Work

Intelligence analysts, in government and in corporate security, use link analysis to map organizations, influence networks, and ownership. Open-source intelligence (OSINT) adds company registries, court records, domain records, and social media as sources.

Intelligence practice grades each piece of information on two separate scales: how reliable the source is, and how credible the information is. The Admiralty system is a common example. On a link chart, the same idea becomes a confidence level and a source on each link, so a reader can tell a documented ownership link from a rumor.

How to Do Link Analysis

1. Start with a Question

"How is Person A connected to Company B?" gives the chart a direction. "Map everything about this case" does not.

2. Extract the Entities

Pull out the people, organizations, places, events, accounts, phones, vehicles, and documents named in your material. Give each one a card.

3. Identify the Relationships

For each pair of entities, record the relationship and label it: "employed by," "director of," "called," "paid," "lived at." A link without a label tells the reader nothing.

4. Record Source and Confidence

Note where each link came from, for example "Phone records, 15 March" or "Interview with witness, Exhibit 4." Mark it as:

• Confirmed - Documentary evidence or direct observation
• Suspected - A single source or a reasonable inference
• Uncertain - Speculation or an unverified claim

5. Add Time

Relationships start and end. Record when each one existed. A director who resigned the week before a transfer matters.

6. Read the Structure

Look at the chart as a whole:

• Degree - Which nodes have the most links?
• Clusters - Which nodes group together?
• Bridges - Which nodes connect different clusters?
• Paths - How are two distant nodes connected?
• Gaps - Which link do you expect but cannot find?

On a hand-built chart you read these by eye. Network tools such as Gephi compute them.

7. Iterate

New information changes the chart. Update it, check which conclusions still hold, and write down the next question.

Patterns to Look For

• Hub and spoke - One entity connects to many that do not connect to each other. Often a leader or a key intermediary.
• Clusters - Tight groups with few links between them. Often separate teams or operations.
• Chains - A line of entities that pass money, goods, or information along.
• Triangles - Three entities all connected to each other. Often a close working relationship.
• Brokers - The only link between two groups. Brokers control what passes between them.

Link Analysis Software and Tools

Link analysis tools fall into three groups: investigation platforms, network analysis tools, and visual boards. The right one depends on how much data you have and who will read the result.

What to Look For

• Labeled links - A line has to say what the relationship is.
• Source and confidence per link - Needed for anything that a prosecutor, client, or editor will read.
• Entity types - People, organizations, places, events, and evidence look different.
• Search and filter - Large charts need both.
• Data location - Case material is sensitive. Know whether the tool keeps it on your machine or on a server.
• Training cost - Platforms such as i2 and Maltego usually need training. A board does not.

For a wider comparison of board-style tools, seebest detective board software.

Link Analysis in Redstrings

Redstrings is a visual investigation board for hand-built link charts:

• Card types - Person, Team, Artifact, Process, Place, Event, Note
• Labeled strings - Each link carries a label, notes, a source, and a confidence level
• Confidence levels - Confirmed, Suspected, or Uncertain, shown on the string
• Search - Find a card by name, notes, tags, or source
• Local files - Boards are files on your machine. Optional AI analysis sends selected board content to Google with your own Gemini key when you run it.
• Reports - Export a board to Markdown with every relationship in a table

Try the demo in your browser, ordownload Redstrings free for Windows 11 or macOS.

Link Analysis FAQ

What is link analysis in criminal investigation?

It is the charting of relationships between suspects, victims, witnesses, phones, accounts, places, and events to find associations, communication patterns, money flows, and timelines that support or weaken a case.

What is the difference between link analysis and network analysis?

Link analysis usually means building and reading a chart of a specific case. Network analysis usually means computing measures such as centrality over a larger network. Many investigations use both.

What software do police use for link analysis?

Many agencies use investigation platforms such as i2 Analyst's Notebook or Palantir Gotham. Smaller teams and individual analysts also use network tools such as Gephi and visual boards.

Can I do link analysis without special software?

Yes. A whiteboard or corkboard works for a small case. Software helps when the chart grows, when you need search, or when each link needs a source and confidence level.