Forensic OSINT

- Chrome Extension for OSINT Web Capture
- Capture Evidence Quickly Before It Disappears
- Includes: OSINT Knowledge base, Video Download and Data Insights!

[Forensic OSINT @ForensicOsint]

I watched a timeline capture run for 18 minutes. I never touched the mouse.

5-min walkthrough of Facebook Timeline Capture: set a date range, approve the post list, and each one opens with All comments expanded before it captures.

11 posts, 11 captured.

#OSINT

[Forensic OSINT @ForensicOsint]

One crawl returned an IBAN, a VAT number, and a regulator license.

None of it was hidden. It sat in footers, terms pages, contact forms and PDFs, spread across pages nobody reads in order.

On its own, each item is unremarkable. Together, they form a profile.

Discovery pulls these out while it maps the site, on every plan including Free.

✅ Emails, phone numbers and postal addresses
✅ Crypto addresses, IBAN, SWIFT and payment accounts
✅ Company registrations, VAT and tax IDs, regulator licences
✅ Tracking IDs, subdomains, tech stack and shared infrastructure
✅ Documents and every external site linked

For fraud work, the corporate identifiers matter most. A registration number gives you a real filing to pull. A regulator license either exists or it does not, and finding out is a search away.

I gather these first because they point outward. They tell me which registry, which jurisdiction, which name to run next.

Take the list wherever you already work. CSV or JSON, no capture required.

See a full extraction → https://t.co/dWGS0PJD2A

#OSINT #FraudInvestigation #OSINTTradecraft #ForensicOSINT #DueDiligence

[Forensic OSINT @ForensicOsint]

A hash calculated an hour later says nothing about that hour.

So it is computed as the file is written, with the time, timezone, browser, OS and version recorded alongside.

🔗 https://t.co/NIzAmy1dDB

[Forensic OSINT @ForensicOsint]

Misuse is not uplift.

The Soufan Center's new report documents how Islamic State and al-Qaeda supporters already use AI, from AI "news" dispatches to chatbot logs in a Vienna plot, and keeps that line clear.

🔗 https://t.co/vNVp0eUarK

[Forensic OSINT @ForensicOsint]

This forest near St Petersburg is fake. On Yandex it is edited over a Russian military site that Yle first reported.

Benjamin Strick shows how to check: repeated shadow shapes, then Google Earth and Esri Wayback history.

🔗 https://t.co/kVP0mB3pj5

[Forensic OSINT @ForensicOsint]

I used to block out a morning to preserve a site by hand.

The judgment was never the slow part. The clicking was.

Scrolling every page. Expanding every comment thread. Keeping a tally of which pages I had already done and which ones I had missed.

Elite Assisted Capture takes the keystrokes. You review the list discovery returns, approve what is in scope, then observe and confirm each capture holds everything on your screen.

The judgment stays where it belongs. So does your ability to say exactly what you saw, and when you saw it.

✅ Website discovery and site intelligence: every plan, including Free
✅ Facebook, Instagram & LinkedIn timeline discovery: ELITE and above
✅ Capturing those pages and posts as evidence: Elite Assisted Capture
✅ Every capture hashed, timestamped and filed to the case

Elite Assisted Capture is $1,699 a year, or $159 a month, through 31 October. Subscribe by then, and you keep that rate for the life of the account. On 1 November, new subscriptions are $2,097 a year.

A tool that saves you a morning is only worth having if you can still account for every step it took.

[Forensic OSINT @ForensicOsint]

How often have you scrolled a long page looking for one name?

Version 3.7.0 of the Forensic OSINT extension adds Keyword Alerts. I recorded a short walkthrough.

You add your case keywords once: names, usernames, aliases, whatever matters to the case. Then you browse as normal. When one of them appears on the page you are viewing, it shows up in the side panel.

✅ Add keywords in Case Management, or select a word on any page, right-click, and choose Add as case keyword
✅ See how many times each keyword matches on this page and across the session
✅ Jump to each hit, or Peek at the wording as it was displayed
✅ Pause scanning whenever you need to

The page itself is never changed. The panel sits beside it.

I find this most useful on long pages where a name is easy to scroll past. It does not replace reading the page. It tells you where to look first.

Also in this release: a dark theme. One setting covers the popup, the side panel and the Case Management System.

Give it a try and tell us what you think.

[Forensic OSINT @ForensicOsint]

A blur on a satellite map tells you something is hidden. A fake forest lets you scroll right past.

Benjamin Strick on a Russian military site painted over on Yandex imagery, plus four more in this week's Friday 5.

🔗 https://t.co/WW2mAGHQoK

#OSINT #GEOINT

[Forensic OSINT @ForensicOsint]

When a client needs something we do not do yet, we build it.

A client asked whether Forensic OSINT could capture LinkedIn endorsements. The honest answer was no. The full list of endorsers was out of reach.

Our dev team picked it up the same day. The video is the prototype on a live profile.

Here is how these requests work.

✅ You tell us what you need to capture, and where
✅ You get a working prototype to use on your case right away
✅ It ships to everyone in a main product release once it is ready

For this one, the prototype adds an Export Endorsements to CSV button. Each row is one endorser, with name, connection degree, headline and profile URL. The run in the video produced 213 rows from a single capture, with every file SHA-256 hashed.

You still check the capture before you rely on it. The prototype does not change that.

If a platform is blocking your collection, send it our way.

[Forensic OSINT @ForensicOsint]

OCCRP's research director shares how her team builds a profile from one clue.

Archive first. Look abroad when a registry is closed. Find the relative who posts publicly. Treat every people-search hit as a lead, not proof.

🔗 https://t.co/lKSVlrT9Xr

[Forensic OSINT @ForensicOsint]

@bellingcat screenshotted Christy Kinahan's UAE visa record in July and again in September.

Expired April 1. Cancelled August 31. Last date to leave: September 29.

Same record, checked twice, dated both times.

🔗 https://t.co/05WwbTUqoJ

[Forensic OSINT @ForensicOsint]

A wicker chair in a Telegram video was the first clue. ProPublica would not publish on that alone.

The proof: a guest's Instagram group photo, with Umar Kremlev in the back row at Trump Jr.'s wedding weekend.

🔗 https://t.co/7gmJ1Mpqs6

[Forensic OSINT @ForensicOsint]

The wedding photos were curated. A guest's Instagram was not, and a Russian oligarch was in the back row.

That, a Kinahan visa record checked twice, and OCCRP's playbook for finding people who hide. This week's Friday 5.

🔗 https://t.co/WW2mAGHQoK

[Forensic OSINT @ForensicOsint]

Discover first, review the list, then capture what you confirm. Website discovery is free on every plan. Capture is Elite Assisted Capture. https://t.co/FvCO482itb #OSINT

[Forensic OSINT @ForensicOsint]

Forensic OSINT v3.7.0 is out. Dark Theme covers the popup, side panel, and CMS. Keyword matches now sit in a side panel beside the page. The page itself is never changed. Sync is faster, with bug fixes. https://t.co/FvCO482itb #OSINT

[Forensic OSINT @ForensicOsint]

She never named her daughters online.

Her video went to Facebook. Meta's AI asked "Who's the child passenger?", named both girls, pulled their ages from relatives' posts, then offered to find where she lives.

A few hundred followers.

🔗 https://t.co/zq7rqIrB5v

[Forensic OSINT @ForensicOsint]

A confirmed username hit proves the identifier exists. It does not prove who controls it.

Omertà, free from The OSINT Vault, labels every result Confirmed, Uncertain or Manual and shows the evidence behind it.

🔗 https://t.co/272d1yhdEC

#OSINT

[Forensic OSINT @ForensicOsint]

Discord, Twitch and Steam are named in the UN CTED trends report published 10 September.

Its argument: terrorist propaganda is no longer merely communicative. It is operational infrastructure for recruiting, fundraising and claiming legitimacy.

🔗 https://t.co/hjNgA7dPqM

[Forensic OSINT @ForensicOsint]

A screenshot with no visible watermark came back clean on Google's SynthID check. OpenAI's tool then confirmed it as theirs.

Detectors mostly read their own maker's mark. "No mark found" is not proof a file is real.

🔗 https://t.co/wruhsw9M34

[Forensic OSINT @ForensicOsint]

She never named her daughters online. Meta's AI named them both, then offered to work out where she lives.

That, a UN report calling propaganda operational infrastructure, and a username tool that shows its evidence. This week's Friday 5.

🔗 https://t.co/WW2mAGHizc

#OSINT

[Forensic OSINT @ForensicOsint]

The account went quiet for four months. That gap was the finding.

A month by month grid across the range tells you which month to open first, instead of reading from the top.

🔗 https://t.co/NIzAmy1dDB