Jigsaw supports investigative analysts (law enforcement, intelligence, journalists) in making sense of large collections of textual reports by visually representing entities (people, places, dates, organizations) and their connections across documents. The workflow enables analysts to explore entity co-occurrence relationships through multiple coordinated views, follow trails of evidence across documents, and progressively build hypotheses about embedded plots and plans.
The input consists of a collection of textual documents — typically short narrative reports (1–6 paragraphs) such as case reports, news stories, or intelligence briefs. Named entities are automatically extracted using NLP (the GATE/ANNIE system), producing typed entities categorized as person, place, date, organization, etc. The analyst reviews and corrects entity identifications interactively: removing false positives, adding missed entities, and changing entity type assignments (e.g., distinguishing "Paris" as location vs. person name). This correction can be applied locally (one document) or globally (all documents).
Entity connections are computed using a simple co-occurrence model: two entities are connected if they appear in one or more documents together, with connection strength proportional to the number of co-appearing documents. Entity frequency (number of documents containing each entity) is also computed. The system generates multiple coordinated views: a List View showing entities sorted by frequency or connection strength with inter-list linking lines; a Graph View displaying entities and documents as a node-link diagram; a Scatter Plot View showing pairwise entity coincidences; a Calendar View positioning documents/entities by date; and a Document Cluster View providing a partition-based overview of the collection.
The analyst begins with a target entity of interest (e.g., a suspicious person) and explores connections interactively. In the List View, they select an entity to reveal connected entities across adjacent lists, with darker orange indicating stronger connections. They expand entities in the Graph View to reveal connected documents and further entities in a satellite layout. They read relevant documents in the Document View to understand context. Through the Scatter Plot View they identify pairwise coincidences, and through the Calendar View they detect temporal patterns (e.g., package drop-offs on Mondays, pick-ups on Tuesdays). Each interaction in one view is communicated to all others via event messaging, enabling simultaneous multi-perspective examination.
The exploration follows trails: starting from an initial entity, the analyst discovers connected entities, expands those to find further documents, reads documents to learn new facts, discovers new entities of interest, and iteratively expands the investigation. The Document Cluster View helps partition the collection to identify relevant subsets and track which documents have been examined. At each step, the analyst assesses whether sufficient evidence has been accumulated or whether further trails need to be followed.
As the investigation progresses, the analyst collects relevant entities and documents into the Shoebox — an evidence marshalling workspace. They organize collected evidence into groups, form hypotheses linking entities and events, construct sentences connecting evidence items, and link to bookmarked view states documenting important intermediate findings. The analyst progressively assembles disparate bits of evidence into a coherent narrative about the underlying plot.
The analyst synthesises findings into a final investigative hypothesis: a narrative explaining the connections between entities, the activities and plans suggested by the evidence, and recommendations for further investigation or action (e.g., surveillance of specific individuals, monitoring of identified locations, investigation of financial transactions).