This article provides instructions on locating items such as Entities, links, keywords, and properties present in multiple graphs.
Often, while working on multiple graphs during an investigation, it becomes necessary to locate items across multiple graphs. This can be achieved in two ways:
- Selecting and copying Entities from one graph to another while noting common Entities.
- Using the feature 'Find in Files' to search items in saved graphs.
Using bookmarks: the select, copy, and paste method:
Firstly, let us work through how we can use the selection, copy, and paste method to find common Entities.
Consider the following graphs for example:
Step 1. Select 'Person One' from Graph1 by using a bookmark color and click the Investigate tab > Select Bookmarked
Step 3. Switch to Graph2 and press Ctrl+v to paste the copied GraphML.
You will see a popup showing the matched Entities.
The "Find in Files" method
Step 1. Select the option 'Find in Files' from the Investigate tab.
Step 2. Fill in search parameters to find all emails ending with '@paterva.com' and click Search
Where: location in file system where the graphs are saved.
Find: piece of string that has to be found.
Graph items: '@paterva.com' is an Entity, check-mark Entities and select 'Email Address' from the dropdown menu.
Search in: Check mark all options to find '@paterva.com' in places other than the value of Entity itself.
Step 4. Similarly we can find text in notes.
Step 5. To find links, use parameters similar to these.