Overview#
Complex investigations rarely fit on a single chronological list. A suspect may appear in one case, a vehicle in another, a phone in a third, and a shared location across all of them. The Cross-Investigation Multi-Track Timeline module gives analysts an interactive time-axis that separates events into tracks while preserving the relationships between entities, evidence, cases, and confidence levels.
Analysts can move from an entity to every investigation where it appears, compare tracks side by side, inspect event detail, and follow relationships without losing the temporal context. The timeline is designed for dense operational use: zooming, filtering, track isolation, event tables, minimaps, relationship overlays, and export are part of the workspace rather than separate reports.
Key Features#
-
Entity-Driven Expansion: Start from a person, place, vehicle, device, wallet, organisation, or identifier and discover the investigations where that entity appears.
-
Multi-Track Time Axis: Separate tracks can represent cases, entities, evidence sources, jurisdictions, teams, or event classes while remaining synchronised on one timeline.
-
Interactive Navigation: Analysts can zoom, pan, isolate tracks, inspect clusters, open event detail, and use minimap navigation for long-running investigations.
-
Relationship Overlays: Links between events show contact, co-location, ownership, transfer, communication, transaction, or other analyst-defined relationships.
-
Evidence-Aware Events: Timeline entries retain links to source evidence, provenance, confidence, review status, and permissions so findings can be defended.
-
Dense Event Table: A tabular view supports sorting, filtering, editing, and export for analysts who need structured review alongside visual reconstruction.
-
Worker-Based Rendering: Large timelines can be processed and laid out without blocking the analyst workspace, supporting high-volume event sets.
Use Cases#
- Cross-case suspect reconstruction where one person appears in multiple investigations with overlapping dates, locations, and associates.
- Vehicle and device correlation where movements, sightings, telemetry, and communications need to be compared on a shared time axis.
- Major incident review where dispatch, evidence collection, BWC footage, witness statements, and communications are tracked in parallel.
- Financial and cyber investigations where wallet events, account activity, messages, and real-world events must be sequenced together.
- Briefing preparation where analysts need a defensible timeline export without flattening the underlying evidence relationships.
- Hypothesis testing where uncertain events can be isolated, compared, and revised as new evidence arrives.
Integration#
The module connects investigation entities, evidence search, graph relationships, event extraction, analyst annotations, and briefing exports. It works as a visual workspace over governed investigation data rather than a separate copy of case records, so access control and provenance follow each event into the timeline.
Open Standards#
- ISO 8601 and RFC 3339: Event timestamps, intervals, and uncertainty windows use standard date and time representations.
- W3C PROV-DM: Timeline events can retain provenance from source evidence, analyst edits, extraction processes, and derived relationships.
- STIX 2.1: Cyber and threat-intelligence events can align with a structured model for indicators, relationships, observed data, and campaigns.
- Plaso / log2timeline concepts: Digital forensic event normalisation follows established timeline reconstruction practices for heterogeneous evidence sources.
- GeoJSON (RFC 7946): Location-linked events can carry portable geospatial context for map overlays and movement analysis.
- PDF/A / ISO 19005: Briefing exports can be prepared in archival document formats where long-term review is required.
- WCAG 2.2: Timeline controls, event tables, focus management, and keyboard navigation support accessible analyst workflows.
Security and Compliance#
Cross-investigation views are permission-aware. An analyst can see only events and relationships they are authorised to access, and saved views retain the same evidence boundaries. Timeline edits, exports, and briefing artefacts are audited so cross-case analysis remains defensible.
Last Reviewed: 2026-06-25 Last Updated: 2026-06-25