Twenty analytical views across four domains — call records, contact intelligence, location and movement, and device and SIM analysis — with built-in security protections. All running locally in your browser.
Calls arranged chronologically in day-grouped cards. Each card shows datetime, direction, calling and called numbers, duration, and cell tower — with subscriber names resolved automatically.
Filter chips for each call type (Voice Out, Voice In, SMS Out, SMS In, Forwarded, Voicemail) narrow the view in real time. Incident date banners mark days falling within investigation windows. A compact timeline with colour-coded bars provides an overview of the full period at a glance.
Stacked bar chart of calls per calendar day, broken down by call type. Reveals trends, spikes, and behavioural change over the full investigation period.
Seven-day centred rolling average lines per call type smooth day-to-day noise to reveal sustained trends. A dashed amber line marks the overall daily mean. Incident markers with configurable weight and brightness overlay dates of significance. Hover tooltips show per-type daily counts and rolling averages. Prints cleanly to PDF including the incident list.
Horizontal stacked bar chart comparing call volumes across all monitored numbers simultaneously, sorted by total descending.
Each bar is broken into segments by call type. Toggle individual call types to refocus the comparison — bars re-sort by the new filtered total immediately. A data table below the chart provides precise counts per number and call type. Useful for identifying the most active numbers at a glance before drilling down.
Statistical summary of call activity: mean, median, min, max, and standard deviation for daily call counts and call durations.
Three statistical sections: daily call count distribution, daily total duration, and individual call duration. A day-of-week breakdown table shows average activity per weekday across the full period. Useful for establishing what is normal for a number before identifying anomalies.
Histogram of voice calls across ten duration buckets — from missed calls (0 seconds) to calls over thirty minutes.
Summary cards show mean duration, median duration, percentage of calls under 30 seconds, and total voice call count. When multiple numbers are in the results, a per-number breakdown section is included below the main chart. A high proportion of very short calls may indicate signalling behaviour.
Seven-day by twenty-four-hour heatmap of call activity — a behavioural fingerprint showing when a number is consistently active and when it is not.
Each cell represents the call count for a specific day-of-week and hour combination, averaged across the full query period. Colour intensity uses a square-root scale so low-activity hours remain visible. No query pre-processing required — runs on any call result set that includes a datetime column.
Swimlane chart with one row per monitored number and one column per calendar day. Shows all numbers side by side across the entire investigation period in a single view.
Bar height within each cell is proportional to call volume (square-root scaled). Incident date bands overlay all rows simultaneously with a configurable opacity slider. A zoom slider (1×–5×) scales the chart horizontally; the page scrolls when zoomed.
Particularly useful for identifying dates where multiple numbers show simultaneous spikes in activity, or where one number goes quiet while others remain active.
Identifies clusters of short-duration calls within a configurable time window — a pattern consistent with pre-arranged missed-call signalling.
Duration threshold slider (0–30 seconds) and cluster window slider (1–120 minutes) are fully adjustable. An optional SMS inclusion toggle catches text-based signalling. An incidents-only filter narrows results to clusters within investigation date windows, with a padding selector to expand the window. A scatter timeline chart shows all clusters plotted by date and time of day — hover a dot to see every call in that cluster, click to scroll to the matching card below.
Identifies gaps in communication activity per number, shown as blocks on a timeline. Unexplained periods of silence are evidentially significant — particularly when they coincide with incident dates.
Gaps of 14 days or more are highlighted. Incident date bands overlay all numbers simultaneously. Each dark period card shows the start date, end date, and gap duration in days. Works across all monitored numbers simultaneously from a single query.
Traces relay patterns: A calls B within minutes of B calling C — identifying potential intermediaries passing communications through the network.
Window slider adjustable from 5 to 90 minutes. Monitored numbers are shown in amber; special numbers (emergency services, operator codes) in purple italic. Chains are presented as A → B → C cards with timestamps and durations. No preset query required — runs on any result set containing calling, called, and datetime columns.
n×n heatmap of shared external contacts between all monitored numbers. The more third-party numbers two monitored numbers have in common, the stronger their apparent association.
Square-root heat scale prevents one high-overlap pair from washing out all others. The diagonal shows each number's own unique contact count rather than a meaningless self-comparison. Hover tooltips show exact shared contact counts. No separate query required — runs directly from any result set containing calling and called columns.
Force-directed graph of the full contact network. Node size is proportional to call volume; edge thickness reflects contact frequency between pairs.
Built with D3.js. Monitored numbers are rendered as larger nodes in a distinct colour; external contacts as smaller nodes. A "Hide hubs" toggle removes the most connected external nodes to reveal structure in the rest of the network. Drag nodes to reorganise the layout; zoom and pan freely.
Useful for identifying dominant connectors — numbers that link otherwise separate clusters — and for understanding the overall structure of the communication network.
Interactive Leaflet map of cell towers derived from MDE records. Movement tracks with directional arrows show how a device moved between towers over time.
OSGB36 National Grid coordinates are converted to WGS84 lat/lng using the full OS Helmert transform (~5 metre accuracy). Tower markers are proportional to log(event count). Directional arrowheads are evenly distributed along each track. Basemap selector: Light (Positron), Streets (Voyager), Satellite (Esri). Resizable sidebar with per-tower event counts.
Event-by-event playback of device movement. Watch a device move between cell towers in chronological order with a growing trail polyline.
Play/Pause button, speed selector (1×, 3×, 10×, 30×), and a scrub slider for direct navigation to any point in the sequence. One coloured marker per monitored number. Multiple numbers can be animated simultaneously from a combined MDE query. Three basemap options matching the Cell Map.
Identifies occasions where two or more monitored devices were registered to the same cell tower within a configurable time window — evidencing physical proximity from network data.
Time gap between the two registrations is shown as a green badge (under 10 minutes) or amber badge (10 minutes or more). Incident date overlay highlights co-location events within investigation windows. Each event card shows both numbers, the cell tower name and postcode, and the gap duration.
Aggregates MDE activity between 01:00 and 05:00 by cell tower. The towers where a device is most frequently registered during overnight hours are the most likely candidates for the subscriber's home area.
Hour range is configurable (default 01–05). Results are ranked by session count per tower per number, with the number of distinct nights and total data volume shown. Works across all monitored numbers simultaneously.
Scans the full MDE dataset for handsets (identified by IMEI) used by more than one monitored number. A single device appearing across multiple SIM cards is significant evidential material.
Results are grouped by IMEI, showing all numbers that used the device, the date range of each association, and session counts. A timeline chart plots the usage periods side by side for direct visual comparison. Works without a pre-existing query — reads the entire MDE dataset automatically.
Gantt chart of device and SIM changes for a monitored number over time. Correlate handset changes with operational events.
One row per unique IMEI/IMSI combination. Incident date bands overlay the chart with a configurable opacity slider. Device-change markers flag transitions between handsets. Useful for establishing when a suspect changed device — for example, shortly before or after an incident — or for identifying burner handsets used for a limited period.
A printable HTML report of the current query results — designed for disclosure, exhibit use, or brief preparation.
Call type cells are colour-coded (matching the analysis views). Phone number columns use monospace rendering for digit-by-digit legibility. Subscriber names are resolved automatically beneath each number. Null values are shown as em dashes rather than blanks. A generation timestamp, record count, and licence watermark appear in the header and footer. Print to PDF directly from the browser.
Downloads the current query results as a comma-separated values file, named with today's date.
UTF-8 encoded, all values double-quoted, internal quotes escaped. Compatible with Excel, LibreOffice Calc, Numbers, R (read.csv), Python (pandas.read_csv), and any standard data tool. Licence watermark comment lines are prepended identifying the recipient — ignored by Excel and most CSV parsers, but present in the raw file. Column names come directly from the SQL query; use AS aliases to customise headers.
Directed graph export of the contact network in GraphML format. Compatible with IBM i2 Analyst's Notebook, Gephi, and Maltego.
Nodes represent phone numbers with subscriber name and provider attributes. Directed edges carry total call count, voice call count, SMS count, and direction attributes. Monitored numbers are flagged as a distinct node type for styling in i2 or Gephi. A licence watermark comment is embedded in the XML header.
Import the GraphML file directly into i2 Analyst's Notebook or Gephi to apply link analysis layouts, filter by edge weight, and produce chart outputs for use in reports or court presentations.
The embedded SQLite database is XOR-encrypted with a unique 32-byte random key generated at build time. The raw base64 payload cannot be opened without the paired HTML file.
The encryption key is generated fresh for every build — no two copies of Arbiter share the same key. Extraction of the base64 payload and decoding it separately produces unusable bytes. The key is stored within the HTML file, meaning the file and its key are always paired.
A SHA-256 hash of the database is computed at build time and verified in the browser on every load. If the file has been modified — by any means — the tool refuses to open and displays a visible integrity error.
Verification uses the browser's native Web Crypto API (crypto.subtle.digest) — no external library required. The hash is verified against the decrypted database bytes before the database is opened, so a modified or substituted payload is detected before any data is accessible.
Each distributed copy carries a unique licence UUID, licensee name, and organisation recorded in the database. A canary record embedded in the call data uniquely identifies the copy.
The licence information is displayed in the Arbiter header after the database loads. The canary call record uses a number derived from the licence UUID — if a copy of the file is disclosed or leaked, the canary record identifies the recipient. Licence details are stamped into all exports.
All exports — CSV, formatted HTML table, and GraphML — are stamped with the licence holder's name, organisation, and licence ID at the point of export.
CSV exports include comment header lines identifying the recipient (ignored by Excel and standard parsers but present in the raw file). The HTML exhibit table footer includes the licensed-to detail alongside the generation timestamp. The GraphML XML header contains a licence comment node preserved when the file is opened in i2 or Gephi.
Request a demonstration with a sample dataset, or contact Expert System Digital to discuss deployment for your unit or organisation.