Anecdotal, and old now: I worked with an ex-NSA agent when I worked at a big bank who worked out of a some of middle east offices in early 2000s. He talked about how new agents often struggle with the size of data (even then) but most good agents work immediately to look at the lack of normal data. Criminals/targets have their own signal of data and by filtering traditional data patterns you're left with a smaller dataset of the targets you're there to find. He used the same patterns to find financial white collar cheaters in bank data.
(example: phones off during day, on from 1am-5am then shut off again, no facebook browsing at all, etc.)
(example: phones off during day, on from 1am-5am then shut off again, no facebook browsing at all, etc.)