What is it?
Activity matrix is a built-in feature available to all Oxygen Forensic® Detective users. Accessible within the Timeline section, it helps detect when the device was most used, sorting that information by hours and weekdays. This feature also enables users to filter their timeline events by hours and weekdays.
Why would I need it?
This feature proves particularly useful when the exact timeframe or time of the event is known and needs to be investigated. For example, if the suspect says they were asleep when a certain crime happened, the investigator can verify by setting the timeframe and viewing the events that took place at that time. Any sent messages or location data could prove that the suspect is not being truthful.
This feature is great for analyzing behavioral patterns, allowing the investigator to easily spot differences in the normal routine. There could be many reasons for such disruptions, and they are specific to each case. This tool is not only relevant to the device owner’s activity, but also to the activity of the contacts in connection with the device owner.
In all, Activity Matrix is a powerful time filter and behavioral pattern tracker, helping the investigator to key in on anything that may contradict or prove the person’s story. However, there are many other cases in which this feature might be beneficial.
To further enhance the examination, the investigator can filter the events within Activity Matrix by application, group, or direction.
What does it look like?
Every hour of a weekday is displayed as a rectangle with the number of events corresponding to the hour written inside. Each rectangle is highlighted in a color which correlates to the frequency of events in that rectangle: green stands for low activity, yellow for moderate, pale orange for high, and red for extreme.
In the total row, the total number of events per hour is displayed. In the total column, the total number of events per each weekday is displayed.
If there were no events at a certain hour of the week, the cell will be empty:
How do I use it?
There are multiple ways in which Activity Matrix could be used. Here are most of them:
- View activity within a specific hour. Select the hour cell you would like to examine and click Apply to view the events. Alternatively, a double left click on the cell would perform the same function. The triangle displayed in the lower-right corner of the cell indicates that only events within the hour cell are displayed.
- View activity within multiple hours. Select multiple cells of interest while holding Ctrl, and click Apply to view the events within them. Alternatively, you can select them by holding the left mouse button, dragging it across the cells in question, and then clicking Apply. Another way to perform the same function is to click the first and then last cell while holding Shift, resulting in all cells between them being selected.
- View activity within specific hours or weekdays. Select the cell from a total column (weekday) or row (hour) and click Apply to view all the events that took place within that particular hour or weekday. Alternatively, double left-click on the weekday or hour of interest.
- View activity within a preset timeframe. Select the timeframe at the upper right corner or in Time Filter tab to view an activity matrix for the chosen timeframe.
- View activity within specific applications. Uncheck the boxes of all irrelevant applications to view an activity matrix for the applications in interest. Alternatively, you can double click the application to use it as a filter.
- Reset the filters. Click Reset to reset all the applied filters and time frames. When no filter was applied, the Reset button remains inactive.
NOTE: Some of the abovementioned functions can be combined. For example, an investigator could view all the events that took place on Monday at 1pm, within WhatsApp, from December 1st, 2019 to February 20th, 2020.
Taking the user experience to the next level
First available in Oxygen Forensic® Detective 12.2, the customization of activity levels is available to further enhance the user experience.
Users can manually set the correspondence between number of events and activity levels (Low | Moderate | High | Extreme). To do so, right-click at any place on the matrix to open Activity levels settings from a drop-down list.
Drag sliders to manually set the percentage correspondence between number of events and the activity levels. 100% means max number of events per hour within the case/extraction.
Our goal is to enhance your experience with Oxygen Forensic® Detective, and we hope you find this feature useful. We always adhere to the needs of our customers, so feel free to share your feedback.
Let’s make this world safer!