Investigation Canvas Tutorial: Map an Email to a Full Case

Why bother with a canvas

Somewhere around the fortieth row, a spreadsheet of accounts stops telling you anything. You know the username came from a breach, but which breach? Was that GitHub profile linked from the website, or the other way round? A graph keeps the how and why on the page: each result sits next to the thing it came from, joined by a line that says what the relationship is.

This tutorial walks through the TraceFind investigation canvas from an empty page to an exported image, using the fictional identity jane.doe@example.com and the handle jdoe-dev. If you want the investigative method behind it, read the investigation workflow first; here we stick to the tool.

1. Open the canvas and sign in

   Go to the canvas page. Signed out, it shows a read-only example canvas behind a short sign-up prompt, which is a good way to look around first. Creating a free account gives you 15 free credits, enough for three searches at 5 credits each, and keeps every case saved to your account.

   

2. Add your seed

   Every case starts with something you already have. There are four ways to put it on the canvas:

   • Pick the type in the search bar at the top (Email, Username, Phone, Domain and more), type the value and press Search.
   • Click an entity in the left panel, or drag it onto the canvas.
   • Double-click empty canvas to add an entity there.
   • Paste emails, phone numbers, URLs or IPs straight onto the canvas. Pasting handles up to 200 lines at once.

   Mark the identifier you trust most as a start object (press S with it selected). Layouts use start objects as anchors, and the hierarchy layout grows outward from them, so the seed stays the root of the case.

3. Know what costs credits

   What happens when you run something depends on the entity type. The question to ask is whether you are searching for a person's footprint or looking something up.

   

   Searches from the canvas behave like the search pages: 5 credits when a search finds something, nothing charged when it finds nothing. On a free account, results can arrive as a locked preview showing counts only; unlocking needs credits. Up to three searches or lookups can run at once.

   Entity types come in five groups (Identity, Online, Infrastructure, Places and money, Evidence), 29 types in all. The ? next to each one in the palette says what it finds.

4. Read what lands

   When a search finishes, its results appear as entities around the one you searched, each joined to it by a labelled line such as "profile on" or "exposed in". A toast tells you how many results and new entities came back, and the small card under a node shows its key properties. The toggle in the zoom bar hides those cards when the graph gets busy.

   

5. Inspect one entity

   Click a node and the inspector on the right shows everything about it: its value and type, colour, shape and size, a list of properties, and a notes field. For an account it also offers Open profile, so you can read the page itself, and actions to run.

   

   Use the notes field for the source and the date, in the same neutral wording you would put in a report. The canvas autosaves; the indicator next to the canvas name shows when it has.

6. Pivot

   The buttons in the inspector are the pivots. A GitHub account can be investigated for free (profile, linked sites, other names it goes by). An account with a username can be searched by that username. A domain gets its own free lookup, which in the demo below added 22 linked entities from 10 sources in one go.

   

   Careful: Every entity the canvas adds is a lead. Before a link counts as a finding, confirm it with a second independent signal, as described in the workflow guide.

7. Link and label

   The canvas links what a search finds, but you add the judgement. Press C for connect mode and drag from one entity to another, or use Connect to… in the inspector. Then click the line to name it. The built-in labels cover the usual relationships: linked to, same person, uses, owns, registered on, profile on, exposed in, alias of, works at, located in, communicates with, paid to.

   

   Lookup results also carry how sure the source is. Findings that TraceFind draws from its own reasoning, such as shared infrastructure, are marked inferred and drawn dashed; they are leads to verify, not facts. Records from live DNS, registries or the page itself are confirmed, and third-party records such as archives or passive DNS are reported. The yellow note in the example canvas ("Same avatar on GitHub and WhatsApp, likely the same person") shows a habit worth copying: say why you linked two things.

8. Arrange the graph

   Searches arrange themselves, but a case you have to explain needs a deliberate layout. The Arrange menu in the toolbar has force-directed, a tidy-up that keeps your arrangement, hierarchy from the top, radial by links, circle and grid, plus layout settings and a lock.

   

   Once the layout is right, lock it so a later search does not rearrange what you have carefully placed. Ctrl+Z undoes a rearrange.

9. Export

   The export button offers two things. Image (PNG, high quality) opens a dialog where you pick the resolution (2x for screens, 4x for print, 8x for posters), the background (dark, light or transparent) and the area (whole canvas or current view). Canvas file (JSON) saves the full graph, which you can re-import later or keep as a backup.

   

   Individual searches can also produce a PDF report: when one is available, the inspector shows a Download PDF report button on that entity.

Shortcuts worth learning

Key	Does
C	Connect mode
S	Start object on or off
A	Actions for the selected entity
O	Open its profile or link
F	Fit the graph to the screen
/	Find on canvas
Shift-drag	Box select
Right-click	More actions
Ctrl Z, Ctrl Shift Z	Undo and redo
Ctrl E	Export

For a long list of addresses or numbers, the Bulk button in the toolbar runs a whole list (CSV or pasted) in the background; the bulk search page explains how it works.

Habits that keep a case readable

Next steps: run the individual searches in more depth with the email guide and username guide, or try a platform investigation as in the GitHub OSINT guide.

Frequently asked questions