Link Analysis: Mapping Connections in an Investigation
A single fact rarely tells you much on its own. A phone number reused across two usernames, a domain registered with the same email as a company filing, a photo geotagged near an address that also shows up in a court record — none of these mean much in isolation, but put together they form a shape. Link analysis is the practice of deliberately building that shape instead of leaving it scattered across a dozen browser tabs and notes.
What link analysis actually is
Link analysis represents an investigation as a graph: entities become nodes — a person, an email address, a domain, a company, a phone number, a photo — and the relationships between them become edges — "registered by", "appeared in the same breach as", "shares a phone number with", "photographed at". Drawn out, a graph like this makes indirect connections visible in a way a flat list of facts never does: two people who never appear together in any single source can turn out to be one hop apart once their individual data points are connected through a shared node.
None of this requires special data — it is a way of organising facts you already found through ordinary OSINT techniques (username searches, breach data, public records, image metadata, infrastructure lookups). The graph does not generate new evidence; it makes the relationships between existing evidence visible and queryable.
Why investigators reach for it
Most real investigations do not fail because there is too little data — they fail because there is too much, spread across too many disconnected sources, for a person to hold the whole picture in their head at once. A graph externalises that picture. Patterns that are invisible in a spreadsheet — a small cluster of accounts that all reference the same obscure email, a company structure where the same handful of addresses reappear across supposedly unrelated entities — become visually obvious once the same data is laid out as nodes and edges.
It also makes gaps visible, which is just as useful as making connections visible. A node with very few edges is a thread worth pulling; a cluster with no path back to your original subject is a sign you have wandered off the actual investigation. Both are hard to notice in a list of notes and easy to notice in a graph.
The workflow: collect, normalise, connect, visualise
Link analysis tools generally follow the same rough sequence regardless of which one you use. First, you collect: gather facts from whatever OSINT techniques apply — searches, public records, breach data, metadata, infrastructure lookups — and capture them somewhere durable rather than trusting memory or open tabs. Second, you normalise: the same email address or phone number often appears written differently across sources, and a graph is only useful if those variants are recognised as the same entity rather than treated as separate, disconnected nodes.
Third, you connect: define the relationships between the entities you have collected, explicitly stating what kind of link each edge represents rather than just clustering things that seem related. Fourth, you visualise: lay the graph out so the structure — clusters, hubs, isolated nodes, chains — is readable at a glance, and can be filtered or expanded as the investigation grows. Skipping normalisation is the most common mistake: a graph full of near-duplicate nodes for the same entity looks busy but tells you less than a clean, smaller one would.
Graph databases vs. transform-based tools
Two different kinds of tool sit under the "link analysis" label, and they solve different problems. Transform-based tools start from a seed entity and offer to automatically run a set of lookups — "transforms" — against it, adding whatever they find as new connected nodes. They are built for exploratory, entity-by-entity investigation, where you keep expanding outward from a starting point one query at a time.
Graph databases instead store a large set of nodes and edges you have already collected — from any source — and let you query and traverse that data directly: find every path between two entities, find every node within two hops of a subject, and so on. They suit investigations that already have a lot of structured data and need it queried and analysed rather than expanded outward query by query. General-purpose graph-visualisation tools sit in between: you feed them a dataset you assembled elsewhere and use them mainly to lay it out and explore it visually.
Keeping your evidence organised
A graph is only as trustworthy as the evidence behind each node and edge, so the discipline that matters most is keeping a record of where each fact came from and when you found it — a screenshot, a URL, a timestamp — attached to the node or edge it supports, not filed away separately. Without that, a graph that looked solid when you built it becomes impossible to defend or even re-verify later, especially once a source page has changed or disappeared.
It is also worth periodically pruning: remove or clearly flag low-confidence connections rather than letting speculation sit visually identical to verified fact. A graph that mixes the two without distinction is the fastest way to convince yourself of a connection that was never actually there.
Tools for this
Related on this site
Common questions
What is the difference between a node and an edge?
A node is an entity in your investigation — a person, an email address, a domain, a company. An edge is the relationship connecting two nodes, such as "registered by" or "appeared in the same breach as". The nodes are what you know about; the edges are how it connects.
Do I need a graph database for a small personal investigation?
Not usually. Graph databases suit large, already-structured datasets that need querying. For a smaller investigation, a general graph-visualisation tool, or even a well-organised spreadsheet paired with a diagram, can capture the same relationships without the overhead.
What is a "transform" in an OSINT link analysis tool?
A transform is an automated lookup a tool runs against an entity you already have — for example, taking a domain and finding its registration details, or taking an email and checking it against other data — and adding whatever it finds as new connected nodes on your graph.
How do I avoid drawing false connections in a graph?
Normalise entities carefully so you are not connecting two different things that merely look similar, attach a source and timestamp to every node and edge, and distinguish verified facts from speculation visually rather than letting them look the same on the graph.