Link analysis is a technique for finding and mapping the relationships between entities — people, companies, phone numbers, bank accounts, vehicles, addresses — so an investigator can see how they connect instead of reading records one at a time. Instead of a stack of spreadsheets and case files, you get a graph: dots (entities) joined by lines (relationships), where a single search returns not just one name but the whole network around it.
If you've ever pinned photos to a corkboard and run red string between them, you already understand link analysis. The digital version does the same thing at a scale no wall can hold — across millions of records, and with every line traceable back to the document it came from.
Why does link analysis matter in investigations?
Most fraud, corruption, and organized-crime cases are not hidden in a single record. They're hidden in the pattern between records. A suspect and a vendor who share a phone number. Three "independent" bidders registered at the same address. A shell company whose director also sits on the board of the agency awarding the contract.
No one document reveals this. The connection only appears when you place the records side by side and ask: who touches whom? Link analysis is how you surface those hidden relationships quickly, instead of hoping an analyst stumbles onto them after weeks of manual cross-referencing.
How does link analysis work?
There are three basic steps:
- Ingest the data. Pull together everything you hold — case files, contracts, bank records, corporate registries, call logs, watchlists, spreadsheets, PDFs. Structured and unstructured.
- Resolve the entities. Decide which records refer to the same real person or company. "Juan Pérez," "J. Perez," and "Perez, Juan A." may be one man — or three. This step, called entity resolution, is what makes the graph trustworthy. (Get it wrong and the whole network is garbage.)
- Map the connections. Draw the relationships between the resolved entities — shared addresses, ownership, transactions, communications, family ties — and let the investigator search and explore the graph.
The output is a network you can navigate: click a person, see everyone and everything one step away, then follow the chain outward.
What is multi-hop link analysis?
A "hop" is one step across the graph. One hop from a suspect gives you their direct contacts. Two hops gives you the contacts of those contacts. Multi-hop link analysis lets you follow the chain several steps out — which is exactly where hidden intermediaries live.
The person laundering the money is rarely one hop from the crime. They're the quiet node three connections away, linked through a nephew, a shared account, and a shell company — invisible to anyone reading files one at a time.
Manually tracing three hops across thousands of records is nearly impossible. On a graph, it's a query.
What's the difference between link analysis and entity resolution?
They work together but do different jobs:
- Entity resolution answers "who is who?" — collapsing duplicate, misspelled, and aliased records into one true identity.
- Link analysis answers "who is connected to whom?" — mapping the relationships between those resolved identities.
Entity resolution comes first and makes link analysis honest. If you map connections before you resolve entities, you get a graph full of phantom duplicates and missed matches — connections that look real but aren't, and real connections you never see.
What data can you use for link analysis?
Good link analysis is only as complete as what you feed it. Useful sources include:
- Corporate registries and beneficial-ownership records
- Procurement and contract data
- Bank and financial transaction records
- Phone/communication logs
- Case files, reports, and investigative notes
- Property and vehicle registrations
- Watchlists, sanctions, and PEP lists
- Unstructured documents (PDFs, scanned files, emails)
The hard part is that this data lives in different systems and formats. A strong platform ingests all of it — structured and unstructured — and unifies it into one graph.
Can link analysis evidence hold up in court?
Only if every connection is source-traceable. A graph is persuasive, but a defense attorney, auditor, or procurement board will ask one question: where does this line come from? If you can't point to the exact record behind each node and edge, the finding is an assertion, not evidence.
That's why traceability matters more than pretty visuals. Every relationship should trace back to the document, row, or registry entry that established it — defensible in audit, procurement review, and court.
Where Axentra Sherloc fits
Sherloc is Axentra's entity-graph intelligence platform, built to do exactly what this article describes. It ingests everything you hold — databases, warehouses, APIs, contracts, PDFs, case files, registries, structured or not — resolves the real people, companies, accounts, and locations inside (including duplicate, misspelled, and aliased records), and maps how they all connect into one graph.
What that gives an investigator:
- Search one name, get the whole network back — not a single record.
- Multi-hop link analysis to follow chains through intermediaries.
- Natural-language search — ask in plain English or Spanish, no query language required.
- Every node and edge source-traceable — defensible in audit, procurement, and court.
- Built for sensitive data — deployable on-premises, sovereign, or air-gapped.
It's used for investigations, anti-corruption and procurement fraud, organized crime, financial intelligence, and enterprise due diligence, KYC, AML, and supply-chain risk. The human stays in the loop: Sherloc surfaces the network and cites its sources — the investigator decides what it means.
If your team is still cross-referencing spreadsheets by hand to find connections that should take seconds, let's talk about what link analysis could do for your caseload.