Article Preview
Top1. Introduction
Analysts across different domains are often tasked with complex exploratory investigations involving large amounts of data. For example, digital forensics analysts often examine data to identify threats among interconnected pieces of evidence from various sources (Pirolli & Card, 2005). Biologists analyze data through iterative cycles of computational analysis, visualization generation, and hypothesis testing (Li et al., 2011). In the domain of cybersecurity, digital forensics often requires analysis of large amounts of digital storage and records of network activity to investigate suspicious behaviors and accurately identify criminal activity (Goodall & Tesone, 2009). For such analytic tasks in real-world situations, analysts commonly rely on a multitude of conventional tools such as Excel, web browsers, text editors, and command-line tools as their main tools due to their complex task requirements and lack of support for rapid foraging across different applications (Endert, Andrews, Fink, & North, 2009). A shared challenge in analysis work is keeping track of process history (Madanagopal, Ragan, and Benjamin, 2019).
Although many general tools have well-determined purposes for analysis, keeping track of the history of the analysis process is difficult due to the complex nature of hypothesis exploration. Specifically, analysts often undertake difficult investigations leading to frequent acts of hypothesis development and testing. As such, it may be difficult to keep track of the many logic paths along with the corresponding data views created via different tools. Overload from various analysis artifacts and data views can make it difficult for the analysts to recall and explain how they arrived at a certain state in the investigation. Such challenges with reporting or quality control can affect the entire investigation (Madanagopal, Ragan, and Benjamin, 2019). Furthermore, the reduced awareness of the analysis artifacts can lead to redundant or unproductive work due to the inability to notice and reuse earlier findings. A survey of workplace practices shows analysts often resort to substandard solutions such as saving numbered versions of files as a means of preserving the history of the process (Fink, North, Endert, & Rose, 2009). Such an approach for maintaining history items can lead to even more confusion because the large number of files eventually becomes meaningless and makes the history of the investigation process virtually irretrievable.
To alleviate these problems in data analytics and sensemaking with visual histories, researchers and developers have designed workflow and provenance tools to help manage, capture and revisit the analytic processes, e.g., (Wenwen et al., 2009; Silva, Freire, & Callahan, 2007; Bavoil et al., 2005). These tools help keep track of the steps taken to create different data views throughout the progression of exploratory analysis to make it easier for analysts to review their work. Many provenance tools represent the steps of the analytic process visually, as is often referred to as a visual history, e.g., (Singh et al., 2011; Gotz & Zhou, 2009; Heer & Shneiderman, 2012). Visual history applications take advantage of the large number of history items indicating snapshot views denoting process milestones and separate lines of investigation, e.g., (Bavoil et al., 2005; Li et al., 2011). By spatially organizing visual history items that pertain to different analysis tasks or datasets on the screen, an analyst is afforded with a visual history that provides an easy to access record of the workspace and analytic process in real time, revealing patterns of branching histories of data items. The core objective for the visual history in the context of the analyst workspace is to minimize any hinderance to task performance caused by the burden of revisiting previous data states. The applications supporting visual histories leave trails of process landmarks as representations of key decisions, divergences in the process, or changes to the data. Prior studies have found that even the final state of the analysis workspace can serve as visual history to enable significant improvements to memory and recall of the analysis process (Ragan, Goodall, & Tung, 2015). Previously, Singh et al. (2011) explored the potential benefits of large high-resolution displays for maintaining visual histories. The authors explored the utility of additional display space for supporting persistent visual history; however, they did not evaluate the effects of workstation space on the process of generating the visual history.