Multiple mobile device identifiers (IDs) of mobile devices and corresponding geolocations of the multiple of mobile device IDs are received from multiple mobile hubs during a time period. A selection of an incident that occurred at a particular geolocation at a particular date and time is then received. One or more mobile hubs of the multiple mobile hubs that were present within a selected geographical zone that includes the particular geolocation during a selected time frame that includes the particular date and time are identified based on at least one corresponding mobile device ID of the one or more mobile hubs. Sensor data obtained by at least one user device communicatively connected to the one or more mobile hubs of the multiple hubs are then associated with the incident.