Connection view

XAMN Pro license required.

The Connection view shows relations between Persons in a case and how these have communicated. To access the Connection view, open your investigation as a case.

Tip: Apply filters before opening the Connection view to speed up the process.

Procedures

View connections and identities

Note: The Persons functionality is available when you work in a case file, with one or more data sources.

Select a Person to highlight connections to other Persons in the case. You can also view the identities that the selected Person has used. Select a hyperlink to view communication from a specific identity or all identities.

Persons are connected with links and link boxes indicating the number of conversation artifacts between them.

Hide connections with few interactions

To make the information in the Connections view easier to digest, you can filter the view to only show connections between persons with more than a selected number of conversation artifacts.

  1. At the top right of the view, enter the Minimum artifact count.
  2. Click OK.

    The view is immediately filtered to only show connections where the number of conversation artifacts is the same as or exceeds the given value.

View conversations between two Persons

  • Click a gray link box to view the communication between two Persons in a case. The conversation is displayed in the pane to the right. Conversation artifacts are separated by date dividers. Dates and weekdays are displayed in the preferred language set for apps and websites in Windows.
  • Any messages that contain location data are marked with the location data icon.
  • To see a list of all attachments related to a conversation, click Thread at the top of the conversation and select Attachments.

Resolve shared identities

The Connection view can help resolve shared identities. To resolve the shared identities, do the following:

  1. Click on a gray box between Persons.
  2. In the pane to the right, click the hyperlinks to resolve shared identities.

For more information, see Persons.

View communication from a specific identity

You can select a specific identity and view the communication in the Connection view.

  1. Open the Connection view.
  2. Select a link box that connects identities. A summary of the identities used is displayed.
  3. Select All communication involving all identities. The identities used in the communication are displayed.
  4. Do one of the following:
    • To view a specific identity, select the desired identity.
    • Select All persons and identities. The connection between identities is displayed in a thread view.
  5. In the dropdown menu, select all identities or a specific identity to filter the result.