diff --git a/code/09_case-clustering.R b/code/09_case-clustering.R
new file mode 100644
index 0000000..ac5c802
--- /dev/null
+++ b/code/09_case-clustering.R
@@ -0,0 +1,113 @@
+# 09_case-clustering.R
+#
+# content: (1) Read data
+#           (1.1) Read log event data
+#           (1.2) Extract additional infos for clustering
+#          (2) Clustering
+#
+# input:  results/haum/event_logfiles_2024-01-18_09-58-52.csv
+# output: results/haum/event_logfiles_pre-corona_with-clusters_cases.csv
+#
+# last mod: 2024-02-04
+
+
+# setwd("C:/Users/nwickelmaier/Nextcloud/Documents/MDS/2023ss/60100_master_thesis/analysis/code")
+
+library(bupaverse)
+library(factoextra)
+
+#--------------- (1) Read data ---------------
+
+#--------------- (1.1) Read log event data ---------------
+
+dat0 <- read.table("results/haum/event_logfiles_2024-01-18_09-58-52.csv",
+                  colClasses = c("character", "character", "POSIXct",
+                                 "POSIXct", "character", "integer",
+                                 "numeric", "character", "character",
+                                 rep("numeric", 3), "character",
+                                 "character", rep("numeric", 11),
+                                 "character", "character"),
+                  sep = ";", header = TRUE)
+dat0$event <- factor(dat0$event, levels = c("move", "flipCard", "openTopic",
+                                          "openPopup"))
+
+# Select data pre Corona
+dat <- dat0[as.Date(dat0$date.start) < "2020-03-13", ]
+dat <- dat[dat$path != 106098, ]
+
+#--------------- (1.2) Extract additional infos for clustering ---------------
+
+datcase <- aggregate(cbind(duration, distance, scaleSize, rotationDegree) ~
+                     case, dat, function(x) mean(x, na.rm = TRUE), na.action = NULL)
+
+datcase$length <- aggregate(item ~ case, dat, length)$item
+datcase$nitems <- aggregate(item ~ case, dat, function(x)
+                            length(unique(x)), na.action = NULL)$item
+datcase$npaths <- aggregate(path ~ case, dat, function(x)
+                            length(unique(x)), na.action = NULL)$path
+
+# datcase$ntopics <- aggregate(topic ~ case, dat,
+#                              function(x) ifelse(all(is.na(x)), NA, length(unique(na.omit(x)))),
+#                              na.action = NULL)$topic
+# 
+# datcase$vacation <- aggregate(vacation ~ case, dat,
+#                               function(x) ifelse(all(is.na(x)), 0, 1),
+#                               na.action = NULL)$vacation
+# datcase$holiday <- aggregate(holiday ~ case, dat,
+#                              function(x) ifelse(all(is.na(x)), 0, 1),
+#                              na.action = NULL)$holiday
+# datcase$weekend <- aggregate(weekdays ~ case, dat,
+#                              function(x) ifelse(any(x %in% c("Saturday", "Sunday")), 1, 0),
+#                              na.action = NULL)$weekdays
+# datcase$morning <- aggregate(date.start ~ case, dat,
+#                              function(x) ifelse(lubridate::hour(x[1]) > 13, 0, 1),
+#                              na.action = NULL)$date.start
+
+datcase <- na.omit(datcase)
+
+#--------------- (2) Clustering ---------------
+
+df <- datcase[, c("duration", "distance", "scaleSize", "rotationDegree",
+                  "length", "nitems", "npaths")] |>
+       scale()
+mat <- dist(df)
+
+hc <- hclust(mat, method = "ward.D2")
+
+grp <- cutree(hc, k = 6)
+datcase$grp <- grp
+
+table(grp)
+
+# k1 <- kmeans(mat, 4)
+# datcase$kcluster <- k1$cluster
+
+set.seed(1658)
+ids <- sample(rownames(df), 5000)
+
+fviz_cluster(list(data = df[ids, ], cluster = grp[ids]),
+             palette = c("#78004B", "#000000", "#3CB4DC", "#91C86E",
+                         "#FF6900", "#434F4F"),
+             ellipse.type = "convex",
+             show.clust.cent = FALSE, ggtheme = theme_bw())
+
+aggregate(cbind(duration, distance, scaleSize , rotationDegree, length,
+                nitems, npaths) ~ grp, datcase, mean)
+aggregate(cbind(duration, distance, scaleSize , rotationDegree, length,
+                nitems, npaths) ~ grp, datcase, max)
+
+res <- merge(dat, datcase[, c("case", "grp")], by = "case", all.x = TRUE)
+res <- res[order(res$fileId.start, res$date.start, res$timeMs.start), ]
+
+# Look at clusters
+vioplot::vioplot(duration ~ grp, res)
+vioplot::vioplot(distance ~ grp, res)
+vioplot::vioplot(scaleSize ~ grp, res)
+vioplot::vioplot(rotationDegree ~ grp, res)
+
+write.table(res,
+            file = "results/haum/event_logfiles_pre-corona_with-clusters_cases.csv",
+            sep = ";",
+            quote = FALSE,
+            row.names = FALSE)
+