The connection graph
What a node and an edge mean on the graph, how grouping and layouts work, and how paths and routes are found.
#Plain languageIn plain terms
The graph draws the result as a map. Each circle is an address or a transaction. Each line is a recorded interaction between two of them. It lets you see the shape of activity that a table hides.
The map contains only what the lookup returned. A line means a record exists. It never means Forensia thinks two addresses are related.
#How it worksHow it works
- Every address or transaction in the activity becomes a node.
- Every recorded interaction becomes a line from sender to recipient.
- Several records between the same two nodes share one line.
- Low-interest nodes that hang off the same hub are folded into one "N others" node to keep the picture readable.
- Expanding a node runs a new lookup on it and merges the answer in.
#Technical detailThe exact rules
Lines are keyed by ordered pair: A to B is a different line from B to A. A record is attached to a line only through its explicit activity reference. Amounts, times and status on a line come from those records.
Grouping
A node can be folded into a group only when all of these hold: it is not the subject, not marked as a list match, not a named registry contract, not pinned or renamed by you, not on a traced path, not already expanded with its own lookup, touches exactly one line, and that line holds at most one record. A group forms when a hub has at least 5 such nodes on one side. Grouping changes the drawing only. Search, tracing and export still see every address.
Layouts
| Layout | Arrangement |
|---|---|
| Flow | Columns by distance from the subject: sources on the left, destinations on the right. |
| Timeline | Left to right by first recorded time. |
| Radial | Rings around the subject by distance. |
Tracing paths
From a starting node, every route along recorded lines is followed in the chosen direction. You can require an asset and a minimum amount, and set how many hops to follow.
| Setting | Default | Range |
|---|---|---|
| Direction | Outgoing | Outgoing or incoming |
| Hops | 3 | 1 to 8 |
| Paths returned | 40 | Fixed |
A minimum amount applies to one asset at a time, because amounts in different assets cannot be compared. Failed records do not count towards a path. No node is visited twice on one path.
Finding a route between two nodes
Selecting two nodes searches for routes of up to 6 hops and returns up to 12. Routes that follow the direction of the lines are tried first. If there are none, routes ignoring direction are shown and labelled as such.
#LimitsWhat it does not tell you
- The graph of one result draws the first 24 activity rows, with at most 28 nodes and 36 lines. A Bitcoin transaction result with a multi-hop trail appended holds at most 36 nodes and 48 lines.
- A path follows recorded lines. It is not a trace of value, and amounts along it are not compared hop to hop.
- Line thickness is the number of records, or, with one asset chosen, the largest single transfer in that asset on the line. Nothing is added together. It is not total value.
- Tracing and route finding make no lookups. They only read what is on the canvas.
- Notes, names and frames you add are your own annotations. By default they last for the tab only. Choosing "Keep on this device" stores them, with paths and pinned positions, in this browser. Captured data is not stored that way.