From a single clue to the whole picture

Gather

An investigation starts with fragments: a name read in an article, a company cited in a register, a domain spotted on a page. As long as they sit in a notebook or in open tabs, there is not much you can do with them.

The first step is to put each piece of information in a fixed place, stating what it is: person, company, domain, phone number. That choice is not cosmetic, it determines the fields you will have to fill in afterwards, and it forces you to decide, right away, what you are actually looking at.

Put down what you are unsure about too. A doubtful piece of information written down somewhere beats a certain one forgotten in a side file. You will correct it or delete it, and that correction is part of the work.

Do not try to fill everything in from the start. An entity with a single field is already more useful than a note in a corner.

Link

A list of entities is not yet an investigation. What counts is what connects them: who runs what, who registered that domain, who was seen at that address.

An unnamed line teaches nothing. A link between a person and a company does not say whether she runs it, works there, or is a customer. By naming it, you write a statement you will be able to justify, and you accept that someone may ask what it rests on.

This is also the moment the gaps show. Two entities you know are connected without being able to say how point at a missing piece. The empty link becomes a task.

If you hesitate over the name of a link, it usually means a piece of information is missing. Put down the most cautious link and come back to it later.

Arrange

After a few dozen entities, a map built as you go becomes unreadable. That is not a flaw in the method: information does not arrive in the order that explains it.

Arranging means choosing a reading. Pulling linked entities together brings out the clusters. Following the direction of the links shows who decides and who executes. Spreading the map from its most connected entity shows what the case revolves around. Lining everything up on a grid helps when you simply want an inventory of what you have.

One investigation can therefore have several valid layouts, and switching between them often reveals what the previous one was hiding.

Change the layout when you get stuck. Staring at a map that teaches you nothing rarely moves things forward.

Hand over

At the end you need two things: an image to attach to a report, and a file you can reopen to carry on.

The image reads immediately, including for someone who has not followed the case. The file holds every entity, its fields, its position and its links: it reopens on another machine without losing anything, and it lets you show how you reached your conclusion.

This is the step most often neglected, and it is the one that counts on the day someone challenges your work. A map that explains its own reasoning defends itself.

Export before reorganising in depth. A dated file takes a few seconds and can save you from starting over.

Three habits that pay off over time

One piece of information, one source. Record where each item came from in the entity’s fields. That is what will let you tell a verified fact from an impression later on.

Separate what you know from what you suppose. A cautious link you will refine later beats an assertive one you will not dare correct.

Reread the map as if someone else had drawn it. If a link does not explain itself when you read it back, a name or an intermediate entity is missing.

Where this method applies

It does not depend on the subject. A newsroom tracing a financial arrangement, a compliance team checking a counterparty and a security department mapping its dependencies all follow the same four steps, with different sources. The use cases set out what each one is looking for.

It does not depend on the tool either. It works on a whiteboard with markers. A tool saves you time on arranging, rereading and exporting, but it does not replace the act of naming the links.