Link analysis software exists to solve that. At its core it does one thing: it represents information as entities and the relationships between them, so that structure which is invisible in tables becomes visible as a network. This is one layer of the broader discipline of investigation data fusion, which combines link analysis with other evidence modalities into a single picture.
The model
Link analysis rests on an entity-relationship representation. Entities are the things an investigation cares about: people, phone numbers, bank accounts, vehicles, addresses, devices, organisations, locations. Relationships are the connections between them: called, transferred to, registered at, travelled with, owns.
Both carry properties – a call has a duration and a timestamp, a transfer has an amount, a registration has a date. The result is a graph, and once data is in a graph, questions become traversals rather than joins.
This matters because the questions investigators actually ask are relational questions:
- Who connects these two people who claim not to know each other?
- Which numbers appear near all four incident locations at the relevant times?
- Which accounts sit between the fraud proceeds and the final beneficiary?
- Who is the most connected individual in this network, and who is the most structurally important – which are usually different people?
Expressed in SQL against a normalised database, those questions are painful. Expressed as graph traversals, they are natural.
What link analysis software actually provides
Ingestion and normalisation. Data arrives as bank statements in one bank’s format, call records in a telecom operator’s format, seized device extractions, registry exports, and free text. Normalising all of it into a common entity model is the largest part of the work and the part most vendors undersell.
Entity resolution. Deciding that two records refer to the same real-world entity. This is the hardest problem in the field and it is where quality is really determined. Transliteration variance in Indian names alone – the same person appearing as Mohammed, Mohammad, Muhammed and Md – will defeat naive exact matching, and the same person may appear under three spellings within a single case file.
Graph analysis. Shortest path between entities, common neighbours, centrality measures, community detection, temporal filtering. These are the analytical primitives.
Visualisation. The chart that most people think of as link analysis. Useful, but it is a presentation layer, not the analysis.
Case management and provenance. Recording where each assertion came from, who entered it, and at what confidence.
Provenance is not optional
The most consequential design question in any link analysis deployment is whether the system records the source of every assertion.
A graph that says a phone number belongs to a person is useless without knowing whether that came from a subscriber record obtained under lawful process, from an informant, or from an analyst’s inference three weeks ago that has since hardened into fact through repetition.
Systems that discard provenance produce confident-looking charts that cannot be defended. Systems that preserve it allow an analyst to answer the question that matters in court: how do you know that? Insist on entity-level and relationship-level source attribution, with confidence grading, and treat any product that treats provenance as an afterthought as unsuitable for evidential work.
Where link analysis fails
Garbage entity resolution. Over-merging creates a person who is actually three people, and produces spectacular false connections. Under-merging fragments a real network into disconnected pieces and hides the connection you were looking for. Both failures are silent. The only defence is to make merge decisions visible, reversible, and reviewable.
Mistaking centrality for importance. The most connected node in a call network is frequently a taxi dispatcher, a shopkeeper, or a customer service line. Structural prominence is a hypothesis generator, never a conclusion.
Confirmation through visualisation. A well-laid-out chart is persuasive regardless of whether it is correct. Analysts should be trained to ask what the chart would look like if their hypothesis were wrong.
Absence treated as evidence. No connection in the data means no connection was recorded in the sources you happen to hold. That is a different statement from no connection existing.
The Indian data reality
Anyone deploying link analysis in India should plan around a specific set of conditions that generic international products handle poorly.
Names transliterate inconsistently and there is no single reliable identifier available across sources for investigative use. Addresses are unstructured and frequently informal. Call detail record formats vary by operator and change without notice. Bank statement formats vary by institution. A substantial share of relevant material arrives as scanned PDFs or images of documents, and a meaningful share is in scripts other than Latin.
A platform that assumes clean, structured, English-language input will consume enormous analyst time on data preparation, which is precisely the time the platform was purchased to save. Evaluate ingestion and entity resolution against your own messy data, not against a vendor’s demonstration set.
Building the capability
Start with a single well-defined use case rather than a general capability. Financial trail reconstruction and communication network mapping are the two that most reliably demonstrate value early, because both have clear inputs and a clear output that an investigating officer immediately recognises.
Invest in the data layer before the analysis layer. Units that build reliable ingestion for their three most common source types get more value than units that buy sophisticated analytics and feed them inconsistent data.
Train analysts in method, not just in software. The failure modes above are analytical, not technical, and no product prevents them.
And be explicit about the legal basis for every dataset in the system. A platform that makes it easy to fuse data also makes it easy to fuse data that should not have been fused. Access control, purpose limitation and audit logging are not compliance overhead; they are what allows the capability to survive its first serious challenge. Platforms such as pi-scout are built around this governance-first approach to link analysis and data fusion.
