Using Visualization Social Analyzer. AccessData Forensic Toolkit
विज्ञापन
विज्ञापन
Chapter 33
Using Visualization Social Analyzer
About Social Analyzer
The Social Analyzer shows a visual representation of email volume contained in the data set. Social Analyzer will display all of the email domains in a project, as well as individual email addresses within the email domains.
Social Analyzer Map
The Social Analyzer map displays emails in the data set group by domain name. These domain names appear on the map in circles called “bubbles.” The larger the bubble, the more emails are contained within that domain.
The bubbles in the map are arranged in a larger sphere according to how many emails were sent to that domain.
The center bubble in the sphere will have the most emails sent from this domain, while domains radiating clockwise from the center will have fewer and fewer emails in their domain bubble. If you want to examine email domains with the most sent emails, concentrate on examining the bubbles in the center of the map.
Email data in the Social Analyzer map can be examined on two different levels. On the first level, you can get an overall view of communications between domains. You can then select domains that you want to examine in a
Using Visualization Social Analyzer About Social Analyzer | 434
more detailed view and expand those domains to view communications between specific email addresses from the domain. For example, if you search for high email traffic between two domains, you can see which two domains have the highest amount of traffic between them. Select the two domains, and expand them to view the email traffic between individual users from those two selected domains.
See Analyzing Email Domains in Visualization on page 438.
See Analyzing Individual Emails in Visualization on page 438.
Elements of the Social Analyzer Map
Element Description
This map presents the overall view of the social analyzer data. The orange rectangle indicates the area displayed in the main social analyzer map. Black dots in the overall view show domains that are either selected or communicating.
You can either expand or collapse the overall view by clicking on the triangle in the upper right corner.
When you select a domain bubble, it is surrounded by a colored double ring. The ring may be colored blue, black, purple, or red. The different colors allow you to distinguish between different selected domains, but they do not have any significant meaning.
Domain bubbles that are not selected, but have sent emails to the selected domain bubble, are surrounded by a single colored ring that is the same color as the selected domain bubble. This allows you to easily tell which domains have been communicating with the selected domain bubble. Domain bubbles that do not connect to any selected domains are greyed out.
Lines connect other domain bubbles to the selected domain bubble. These lines represent emails sent to the selected domain from other domains. The more emails that have been sent to the domain, the thicker the line between domain bubbles are. You can also see emails sent from the selected domain. Select
Show Reversed Connections in the Social Analyzer panel to show visual representations of emails sent from the selected domain.
A domain bubble with an orange ring indicates that a domain has been connected to from another domain multiple times. This allows you to pinpoint domains that have heavy communication between them.
Using Visualization Social Analyzer About Social Analyzer | 435
Accessing Social Analyzer
To navigate throughout the Social Analyzer pane, click and drag inside the pane. Hover over an email domain bubble to view the total number of emails that were sent from the domain.
Note: Expansion of large datasets may result in slow server speeds and slow rendering the Social Analyzer visualization data.
To access Social Analyzer
1.
Click Project Review.
2.
In the Item List panel, click Options > Visualization > Social Analyzer.
Social Analyzer Options Panel
Using Visualization Social Analyzer About Social Analyzer | 436
Social Analyzer Options
The following table identifies the tasks that you can perform from the Social Analyzer panel
.
Social Analyzer Options
Element
Apply Visualization
Cancel Visualization
Description
Applies the visualization graph filters to the Item List grid. Once applied, only those items filtered with visualization will appear in the Item List grid.
Cancels the visualization graph filters and exits out of
Visualization.
Refreshes the Social Analyzer pane.
Refresh
Clears the selected bubbles in the Social Analyzer pane.
Clear Selections
Select Most Connected Items
Expand Selected Domains
Zoom In
Zoom Out
Selects the ten bubbles that have been most connected to in the
Social Analyzer pane. Each time you click this icon, the next top ten bubbles will be selected, and so forth.
Expands selected domains in the Social Analyzer pane. You can
drill down to a second level to examine the email data. See
Analyzing Individual Emails in Visualization on page 438.
Zooms into the Social Analyzer pane. If you are unable to view the social analyzer data, click Zoom In to locate the data. You can also zoom in by expanding the slider bar located at the bottom of the Social Analyzer pane, by using the + key on the keyboard, or by scrolling the mouse wheel up.
Zooms out of the Social Analyzer pane. You can also zoom out by expanding the slider bar located at the bottom of the Social
Analyzer pane, by using the - key on the keyboard, or by scrolling the mouse wheel down.
Expands and collapses the overall map of the data set. Dots that appear in black in the overall map are domains/emails that are connected to the selected domain/email. The orange rectangle on the map shows where the expanded location is on the map.
Using Visualization Social Analyzer About Social Analyzer | 437
Social Analyzer Options
Element
View
Stats
Description
Show Reversed Connections - Select to show all reversed connections in the pane. Reversed connections are emails sent from a particular email or email domain.
Show Connections - Select to show the connections between domains in the pane. Connections are emails sent to a particular email or email domain.
Preview Connections on Hover - Select to view connections between domains when you hover over them. This option is not selected by default to speed rendering of the map.
Email Display - Display email domains either by the display name or address.
Bubble Limit - You can choose a display limit of either 2,500,
5,000, or 10,000 domains. Server issues may occur with larger display limits.
Displays the statistics of either the first or second level of the email domain data. You can view:
The total number of domains, emails, and bubbles in the pane.
The total number of selected domains, emails, and bubbles in the pane.
The total number of domains, emails, and bubbles that have been expanded.
You can access the second level of data by clicking Expand
Selected Data.
Analyzing Email Domains in Visualization
Once you have you opened the Social Analyzer pane, you can isolate and examine individual email domains.
Note: Social Analyzer is very graphics-intensive. In order to avoid server issues, you should cull the data with facets and other filters to isolate the information that you want to examine before viewing it in Social
Analyzer.
To analyze email domains in Visualization mode
1.
Click Project Review.
2.
3.
In the Item List panel, click Options > Visualization > Social Analyzer.
Click the domain bubbles to select the domain(s) that you want to view.
4.
5.
6.
(optional) If you want to view the top ten domains in terms of received emails. click click this icon, the next top ten bubbles will be selected, and so forth.
. Each time you
(optional) You can zoom in and zoom out of the Social Analyzer panel. If you hover over a domain bubble, the full display name and address, as well as the count, is displayed in the tool tip.
You can expand selected email domains and examine individual emails in a domain. See Analyzing
Individual Emails in Visualization on page 438.
Analyzing Individual Emails in Visualization
You can expand email domains to display individual emails and the traffic between those emails.
Using Visualization Social Analyzer About Social Analyzer | 438
To analyze individual emails within selected email domains
1.
2.
3.
Click Project Review.
In the Item List panel, select Options > Visualization > Social Analyzer.
Click the domain bubbles to select the domain(s) that you want to view.
4.
5.
(optional) If you want to view the top ten domains in terms of received emails. click click this icon, the next top ten bubbles will be selected, and so forth.
. Each time you
(optional) You can zoom in and zoom out of the Social Analyzer panel. If you hover over a domain bubble, the full DisplayName and address, as well as the count, will be displayed in the tool tip.
6.
Click to expand the domain names to display the individual emails.
Using Visualization Social Analyzer About Social Analyzer | 439
डाउनलोड
विज्ञापन