Never lose track (of communications) again: here's how to list phone calls with Mercure

In an investigation, analysts have to deal with large amounts of data coming from different data sources such as telecom, transaction and location data. By aggregating this data in one platform, the most complete picture can be formed. Mercure enables the merging of different data sources (more than 1,200 formats). The software effortlessly transforms data into a single readable format. Users can then query the data with built-in queries for in-depth analysis.

To quickly and accurately understand the communication between two or more parties, you’ll want to display the merged data chronologically. In this article, we explain how to do that in Mercure using the following steps:

1. Adding tags
2. Filtering communication between parties using tags
3. Displaying the filtered communication chronologically

Adding tags
In Mercure, it is possible to tag certain data. Tagging involves marking e.g. a phone number, username, bank account number or other item in the case with a colour. Working with tags makes the items stand out more, but it also allows you to search a dataset for communications in which the tagged item appears. The tags can be created per user, but it is also possible to share them in a team. For example, a team can agree to use a particular colour and tag name for phone numbers, IMEIs, and usernames of the suspect. This way, it is clear at a glance, based on the tag colour, that the data belongs to the suspect. There is the option to reuse the created tags for other investigations.

This is how you create a tag:

Select a person's phone number, IMEI, IMSI, username, and so on. Right-click and navigate to ‘Tag’’ --> ‘With an other tag…’.

In the next window, it is possible to create a new tag by clicking the ‘Create tag’ button.

After this, it is possible to give the tag a title, a description, a colour, and set who the tag is visible to.

After the tag is created, the phone number is given a different colour. This tag can be reused to also mark other details of the suspect with the red tag. In the example below, the suspect's usernames are also marked with the same tag.

Filtering communication between parties using tags
To look up communication between two or more parties, it is necessary to mark the other party's data with a different tag colour. In this example, we look for communication between the suspect and the victim within histos and extractions. The suspect's data has been coloured red and the victim's data has been coloured blue. The colours are immediately reflected in both person’s histos, making it clear at a glance that communication has taken place between the two parties.

Of course, it is important that communications that took place other than via telephony are also made transparent. Tag search makes it possible to search within claims by counterparty tags. This allows searching for the victim's blue tag in the histo and extraction of the suspect. You do this as follows:

Select the suspect's items and right-click to reveal the drop-down menu. Then navigate to ‘Tables’--> ‘All entities’ --> ‘Search tagged entities…’.

In the next window, you have the option to search for the victim's tag. By ticking the 'With a selection of tags' option, you can use the magnifying glass to select the appropriate tag.

You can search specific services, groups or by user. In addition, it is possible to search by tag name and you can select multiple tags if, for example, you want to look up the communications of multiple people in a case or claim.

By selecting the appropriate tag(s), communication between the suspect and victim is searched for in the various claims. The results window shows if and when communication took place between the two parties.

To display more information about the communication that took place, it is necessary to select the items in the 'Value' column and then navigate to 'Table' --> 'Communication of number'.

The following overview shows exactly when communication took place and what, if any, the content of the conversations was.

To represent the communication between the victim and the suspect, the same steps described above can be performed. For this, the victim's claims must have been selected and this data will have to be searched for the suspect's (red) tag.

Displaying the filtered communication chronologically
To display the communication between the two (or more) people in one overview, some additional steps need to be performed. First of all, it is necessary to add an empty list to the workspace into which the communication can be copied. For this, an 'Other...' communication list can be created under the 'Table' option --> 'Telephony'.

Give the list a name, e.g. ‘Communication between parties’, and copy the communication here. Copying this data is done as follows:

Split the cells in which the communication between the two parties is represented using the 'Split cells' option.

Then select the full overview and select 'Copy communications' and copy the data to the empty 'Other communications' list.

Then repeat this with the communication from the victim to the suspect. In the 'Other communications' list, a chronological order of communications is now visible, including any content of conversations.

Now that the communication between two parties can be read clearly and in chronological order, the events that took place can be easily reviewed. Especially when the content of the communications are insightful, such as the SMS messages from an extraction or the content of the conversations had during an interception. This information can be used to confirm or disconfirm statements and helps in mapping performed actions of the parties under investigation.  

Contact
If you have any questions about above procedure in Mercure or if you would like to know what Mercure can do for you, please contact us.