Trace layout

Trace layout

Following the money one step at a time, arranging it, and choosing what to show, hide and group.

• Trace (under Layout) - the layout the workspace starts in, for working from a single piece of evidence, such as a threat actor's wallet, and following the money. Open a wallet or a transaction and it shows only the one wallet or transaction you started from (marked START). Click ▶ beside a vertex to show where the money went, ◀ for where it came from; each click moves one wallet along the chain and the vertices already on screen stay where they are, so the picture grows without being rearranged. A wallet click shows the transactions that spent from it and the wallets they paid; a transaction click shows its wallets. The handle says how much is waiting: 3 is three known vertices, 3+ means more may exist because the wallet's history is not fully loaded, ? means nothing is known yet and clicking will look. Large payouts are shown in batches (the most transactions per expand limit, largest amounts first) with the rest still counted on the handle; Shift-click a handle (or use Choose what to show… in the right-click menu) to get a list and tick exactly which hidden vertices to show. Double-click = ▶, [ and ] = ◀ ▶ for the selected vertex, Ctrl+Z takes the last step back, Reset to start returns to the single vertex (and, like Start over from here, is one step: Undo, Ctrl+Z or the Undo button in the message puts the whole trace back, with every vertex, place, starting point and its own earlier steps), and right-click gives Hide this branch and Start a new trace here. Drag vertices where you want them; drag one of several selected vertices (after Select this branch, a box or Shift-click) and the whole selection moves together by the same amount, where x means time each keeps its time and moves up or down; the trace, with positions, is saved with the session and in the JSON export. Nothing is ever removed by a click, and you decide what stays: select vertices (click, Shift-click, Ctrl+A, or Select this branch) and use Hide selected or Keep only selected; right-click gives Hide this vertex (only it; what it revealed stays) and Hide this branch (it and everything revealed because of it). Hidden vertices stay loaded, their neighbours' handles count them again so they can be shown again, Delete hides rather than deletes, and Ctrl+Z undoes every one of these. Opening a new wallet or transaction adds it as another starting point (each is marked START) placed clear of what is on screen; Start over from here replaces the trace instead. Everything loaded stays in the workspace, so switching to another layout shows it all, and the time slider, minimum amount, fiat display, tags and labels all work in a trace.
• Arranging a trace: Columns, Flow, Timeline, Timeline + force, Force, Time × amount - the Arrange menu in the Trace bar decides where what you revealed is placed, without changing what is shown. A trace starts in Columns, which keeps every vertex where you put it (described above); a saved session or export keeps the arrangement it was saved with. Flow lays exactly the vertices you traced out left to right in the direction the money moves (what funded a transaction on its left, what it paid on its right), the tidy picture of a trace; the arrows keep working, and switching back to Columns returns every vertex to where you had put it. Timeline spreads the vertices over time, left to right, with the time axis and the Compact/Proportional scale choice. Timeline + force merges the two: time runs along x exactly as in the timeline, and up and down a force layout takes over, so the edges pull the vertices they join to the same height and a chain of payments runs roughly level across the page while the side payments fan out above and below it (shapes take room by their size, nothing overlaps, and adding to the trace continues from where things are instead of reshuffling). Force pulls connected vertices together in every direction. Time × amount puts time along x exactly as the timeline does and the amount up the page on a log scale, so big movements stand high and a burst of small ones sits low, with a labelled amount scale at the left (a transaction stands for its total output, a wallet for the largest single movement it took part in). Equal amounts at the same time are spread apart so nothing lands on anything. The other arrangements place everything again each time you add something (with an animation), while Columns never moves what is there; the positions you built in Columns are kept, and switching back restores them exactly. Where x is time (Timeline, Timeline + force, Time × amount, and the Timeline layout) a transaction can only be dragged up and down, so it always stays at its time and the axis stays true; hold Shift to move it sideways as well (the details panel and a first click say so). A wallet, a coinbase, an OP_RETURN output or a group has no time of its own, so it is never held: it is placed between the transaction that made it and the one that spent it, and you can drag it anywhere. A dragged vertex stays where you put it until Re-layout. The choice is saved with the session and the export.
• Arrows with many vertices behind them - in the Trace layout a click on ◀ or ▶ (also a double-click, [ / ], the right-click menu and the buttons in the details) no longer floods the screen. Up to the step size (5 by default) it shows everything, as before. With more behind the arrow it opens a list beside the arrow instead: the top few come ticked (the largest, unless you chose another order), and you press Show 5 ticked, or change the ticks first. The list can be sorted (largest, smallest, newest, oldest; the order you pick is remembered the next time it opens, and the ticked ones are the first few in that order), narrowed by smallest amount and by dates ("12 of 83 match"), and every row says who is on the other side ("to Robinhood Hot Wallet, bc1q… · 2022-04-15"); one box, Tick all · none · top 5 (beside Group similar rows), goes one step round on each click: every row that is listed, none, the first five in the order shown, and round again (the word for what is ticked now is bold; a dash means the top five or some other mix, and a click on another mix goes to all; with no more rows than the step size it is only all and none), and Esc or Cancel leaves everything as it was. Click again and the list holds only what is still hidden, again with the next five ticked, so the trace grows five at a time. Hover an arrow for numbers without clicking: "83 transactions · 12.4 BTC in total · largest 3.2 BTC · 2021-03-02 to 2022-06-10". Shift-click always opens the list. Under Expansion limits the behaviour is a setting: ask which to show when there are many (the default), show the largest few, a few at a time (a click shows the next five, no list) or show everything (up to the limit below) (the previous behaviour), and "Many" means more than sets the step size (1 to 50). Both are remembered. A wallet whose history is not loaded yet is loaded first, and then the list asks.
• A wallet's transactions, told apart - select a wallet and its Transactions list in the details is split into what came in and what went out: each row has a coloured tag (↓ in, ↑ out, ↔ self), who is on the other side (the wallets that paid it, or the ones it paid; your label or the built-in name when there is one), the date and the amount (+ or −), and the transaction id underneath. Change that came back to the wallet is netted off, so a payment with change reads as one out for what really left (the tag's tooltip says so); a transaction that only moved money between the wallet's own addresses is self; a transaction known only from an input, and not loaded yet, is listed last, marked "no details yet". All / In / Out filter the list (with counts), a line above gives the totals in and out, and the list can be ordered newest, oldest, largest or smallest first, or known or labelled first, and narrowed to skip known services, only known or labelled and unspent only (the same controls as the arrow list, below; a row whose spending is not known is left out of unspent only, and the list says so); long lists show 40 rows and a button for more. Hovering a row outlines that transaction on the graph, a click moves the focus to it, and in the Trace layout a row that is not on the trace yet has a + show button that puts just that transaction (and the wallets around it) on the trace. In the other layouts + show (and Show on graph for the ticked rows) brings it onto the graph: what you hid is shown again, and the Focus view is switched off when that is what keeps it out. Folding rows into one vertex (As one vertex) is a Trace-layout feature.
• Several transactions at once - every row of a wallet's Transactions has a tick box, a group has one that ticks all its members (half-ticked when only some are), and all listed ticks everything the All / In / Out filter shows, including what is inside groups. A bar under the filter says how many are ticked and offers, in the Trace layout, Show on graph (n) (puts those transactions on the trace in one go: the ones the wallet spent in come forward, the ones that paid it come from behind; rows already on the trace are not counted), As one vertex (folds them into a group vertex, one per direction; needs two that are not on the trace yet), Copy ids (one transaction id per line) and Clear; in the other layouts it offers Select on graph (selects the ticked transactions that are on screen), Copy ids and Clear. Ticks stay while you change the order, the filter or the paging and when you look at another vertex and come back, but not when you look at a different wallet; a tick on a row the filter hides does not count until it is listed again.
• Grouping similar rows - a busy wallet no longer buries you in lines. In a wallet's Transactions and in the list behind an arrow, three or more rows with the same wallet on the other side ("6 transactions to bc1q…, 2022-04-15, 0.0005 to 0.00055 BTC each, −0.00315 BTC") or three or more small ones (each under a limit, 0.0001 BTC to start with: Small means under (sats) under Expansion limits, 0 switches the small groups off) fold into one line. A wallet shared by the most rows groups first, so a row is in at most one group, and direction matters (what a wallet paid and what it received never mix). Nothing is hidden: click a group to list its transactions, the copy icon copies all their ids, the totals and the range are on the line, the heading still counts every transaction, and Group similar rows (in the list, or under Expansion limits) switches it all off. In a trace, a group has + largest 5 (the step size) and + all N to put the biggest few or all of them on the trace without opening it. In the arrow list, a group has one box that ticks all its rows (half-ticked when some are), an arrow to list them one by one, and "4 of 6 match" when the amount or date filters hide some. Group rows by (under Expansion limits) can fold the rows by the period they happened in instead: month, week, day or year (UTC), three or more rows of one direction in the same period. This is plain counting - how many rows look alike - not a statement about who owns what.
• Groups as one vertex (Trace layout) - several hidden neighbours of a vertex can stand on the trace as one vertex, drawn as a stack of cards with its text ("6 transactions to bc1q…") and one edge carrying their total. Make one from a wallet's Transactions (the ◼ as one button of a group), from the arrow list (◼ as one on a group row, or Ticked as one for the rows you ticked). A group hangs from the vertex whose arrow it came from, forward (to the right) or behind it (to the left), and the arrow's count no longer includes what is in it. Select it for its details: what it stands for, the total, each amount's range, the dates and every member, each with + show and a copy icon; Show the largest 5 (the step size), Show all N and Choose which… put members on the trace as ordinary vertices (what is left stays folded; fewer than two left and the group is dissolved), and Copy ids and Hide group do what they say. Double-click shows the largest few; right-click has the same menu. Everything is undoable (one step each). A group is a way of showing hidden vertices, never data: it is not written into the graph, so the CSV, GraphML and JSON exports, the analysis and the clusters see only what is on the chain; the saved session and the JSON export keep it in the trace data (its members by id), and an import ignores a group that does not make sense. The report lists every member of every group in its own section and in the embedded evidence, so a group never hides evidence, and its picture shows the group as drawn. Hiding a vertex takes the groups hanging from it along (and undo brings both back); opening a folded vertex any other way takes it out of its group. A group can carry a label, a tag and a note of its own (select it: they show on the vertex, in the colour legend and in the report's heading for the group); when an auto-expand showed a vertex that was folded into a group, Undo puts it back in the group; and a JSON export of the Visible part only keeps the members of its groups, so the group survives an import.
• Time bar and arrows - with the time bar narrowed, the arrows in the Trace layout count and show only what falls inside the range (what is outside would not be drawn): the tip says "N more fall outside the time bar's range", the list says how many are not listed, a handle with nothing inside says so, and a transaction whose time is unknown is kept. Arrows stay within the time bar's range under Expansion limits switches it off. A range for the arrows alone: in the Trace layout, dragging across the time line's graph chooses a stretch of time that only the arrows and their lists reach; it hides nothing and leaves the time bar's own window alone, a chip says Arrows reach … → … and its × clears it, and a click without a drag still selects what is under it.
• More controls in the arrow list - show narrows the list to skip known services (wallets on the built-in list or a label list you loaded; a wallet you labelled yourself is not skipped) or only known or labelled; unspent only keeps the outputs that are not spent yet, where that applies (transactions' outputs, and the transactions that paid a wallet once their spending status is known; it is not offered where it means nothing); and Known or labelled first is an order (labelled by you, then known, then the rest, each largest first).
• Selecting and hiding, in every layout - select by clicking, Shift-clicking to add, or dragging a box (Shift-drag on the background, or switch ⬚ Box on with B so a plain drag draws the box; Esc leaves it). Select ▾ in the bar picks everything on screen, none, the inverse, all wallets, all transactions, everything at or above an amount (in BTC, for wallets, transactions or both) or everything carrying a tag; Ctrl+A selects everything on screen and the details of a mixed selection can be narrowed to Wallets only or Transactions only. Hide selected (or Delete) takes them off the screen without deleting anything: they stay loaded, their neighbours stay, the Focus vertex is never hidden, and Ctrl+Z (or Undo) brings them back. Keep only selected hides everything else on screen. Hidden (n) ▾ lists what you hid and shows some or all of it again, also undoable. What you hid is saved with the session and the JSON export. Hide is not Delete: hiding only takes a vertex off the screen (it stays loaded, and Undo brings it back); Shift+Delete and Delete from workspace (in the details, the right-click menu and, in a trace, next to Hide from the trace) really delete it from the workspace, with a message whose Undo (or the top bar's Undo load) brings it back. In the Trace layout hidden vertices come back through the neighbours' handles.