OSINT Techniques

Co-Founder, Forensic OSINT

[email protected]

[OSINT Techniques @OSINTtechniques]

🚨I've been tracking Metro Vancouver Shootings 🚨 The BC Gang Conflict since 2021. Check out the map here.
Red for public shootings and black for residential shootings. The colour difference highlights public safety concerns.
https://t.co/IsVX68adQb

[The New York Times @nytimes]

Breaking News: Meta must pay $25 billion, one of the largest penalties levied against the tech giant, for deceiving users about data privacy. https://t.co/Ne6UrUiwJD

[WIRED @WIRED]

Researchers at The Citizen Lab have for the first time released technical evidence of sophisticated mercenary spyware being distributed via online advertising. https://t.co/pvYw3gJHu3

[Trace Labs @TraceLabs]

🔍 Sponsor Spotlight: Forensic OSINT!

Thanks to @ForensicOsint for supporting the Trace Labs Global OSINT Search Party CTF on Oct 24! Their Chrome extension captures hashed, timestamped, court-ready evidence. 💙

🔗 https://t.co/UM2ogEsNBm

#OSINT4GOOD #TraceLabs #OSINT #CTF

[OpenAI Newsroom @OpenAINewsroom]

We discovered a sophisticated recording device that was hidden inside one of our offices. We used our models to understand the device and where it had come from, identifying that a specific employee had planted it a few days earlier. We referred the matter to the FBI, and we’re grateful to the agents and prosecutors who moved quickly to make an arrest. The FBI’s investigation is ongoing and we will continue to support their work.

At this time, we have no indications of this individual inappropriately accessing or exfiltrating model weights, source code, or customer data. The employee was terminated.

We take protecting our technology, data, and people seriously, and as a matter of national importance. Our security program is designed to protect against a wide range of threat actors, from insider risks to cybercriminals to nation states, and this case is an example of how AI can help address these sophisticated security threats.

[Benjamin Strick @BenDoBrown]

I saw a lot of impressive pieces over the past month in the digital investigations & OSINT space.

Here's five to bookmark and check out 👇

1. https://t.co/PnHyCLmPma: Almost four years of community detective work by @georainbolt and the team to find where a photograph of a woman and her late mother was taken.

2. https://t.co/Qk9YxfxiwU: @bilawalsidhu and a growing community are bringing scattered public datasets together in an open-source mapping project.

3. https://t.co/bhFwZZHq6j: @ThomasBordeaux7 & @Gabor_Friesen geolocated scenes from a journalist’s 2012 captivity video, contributing to the wider investigation into his disappearance.

4. https://t.co/oPttgaoC4o: Important reporting by @guardian, combining survivor testimony, satellite imagery and verified footage to document rebel forces’ destruction of Rohingya villages in Rakhine, Myanmar.

5. https://t.co/yBkXy49LXq: @Nrg8000 preserved high-resolution aerial imagery of northern Gaza from GovMap, where parts were subsequently obscured again. See it on @SoarAtlas here: https://t.co/XHgKlekfRx

These were in my OSINT Field Notes newsletter. Here's the full thing:
https://t.co/U3yGzYWFHm

[FBI Cyber Division @FBICyberDiv]

🚨 Today, the @FBI and @TheJusticeDept announced a series of coordinated actions against the North Korean IT Worker threat – securing charges against 14 individuals, making two arrests, seizing nearly 190 devices, and conducting operations at more than 40 suspected “laptop farms” across Texas.

These actions were taken in response to North Korea’s ongoing deployment of thousands of remote IT workers to infiltrate Western companies, earn revenue for the regime, and gain access to sensitive information. These workers are often supported by domestic enablers and laptop farms.

Disrupting these schemes remains a top priority for the FBI. In 2026 alone, 8 individuals have been sentenced to prison for their roles in this activity.

Coordination between the private sector and federal law enforcement was central to the latest effort. CrowdStrike’s Counter Adversary Operations team provided vital support to the FBI’s effort to identify and disrupt these laptop farms.

https://t.co/OxJ7sFoAQn

[Cyber Detective💙💛 @cyb_detective]

Forensic OSINT Knowledge Base

Practical tips and techniques for WhatsApp, Telegram, Tinder, Instagram and other social media platforms.

https://t.co/baGN6ldikF

By @OSINTtechniques

#socmint

[Forensic OSINT @ForensicOsint]

A hash calculated an hour later says nothing about that hour.

So it is computed as the file is written, with the time, timezone, browser, OS and version recorded alongside.

🔗 https://t.co/NIzAmy1dDB

[Forensic OSINT @ForensicOsint]

One crawl returned an IBAN, a VAT number, and a regulator license.

None of it was hidden. It sat in footers, terms pages, contact forms and PDFs, spread across pages nobody reads in order.

On its own, each item is unremarkable. Together, they form a profile.

Discovery pulls these out while it maps the site, on every plan including Free.

✅ Emails, phone numbers and postal addresses
✅ Crypto addresses, IBAN, SWIFT and payment accounts
✅ Company registrations, VAT and tax IDs, regulator licences
✅ Tracking IDs, subdomains, tech stack and shared infrastructure
✅ Documents and every external site linked

For fraud work, the corporate identifiers matter most. A registration number gives you a real filing to pull. A regulator license either exists or it does not, and finding out is a search away.

I gather these first because they point outward. They tell me which registry, which jurisdiction, which name to run next.

Take the list wherever you already work. CSV or JSON, no capture required.

See a full extraction → https://t.co/dWGS0PJD2A

#OSINT #FraudInvestigation #OSINTTradecraft #ForensicOSINT #DueDiligence

[CSIS Canada @csiscanada]

Foreign interference is more sophisticated and agile than ever before. Instead of just targeting elections, adversaries exploit everyday news trends to fuel social divides and weaken democratic values. Verify your info before sharing or making arrangements.https://t.co/FyKzznwvzW

[Forensic OSINT @ForensicOsint]

Misuse is not uplift.

The Soufan Center's new report documents how Islamic State and al-Qaeda supporters already use AI, from AI "news" dispatches to chatbot logs in a Vienna plot, and keeps that line clear.

🔗 https://t.co/vNVp0eUarK

[Forensic OSINT @ForensicOsint]

This forest near St Petersburg is fake. On Yandex it is edited over a Russian military site that Yle first reported.

Benjamin Strick shows how to check: repeated shadow shapes, then Google Earth and Esri Wayback history.

🔗 https://t.co/kVP0mB3pj5

[CityNews Vancouver @CityNewsVAN]

#BREAKING NEWS: A 30-year-old Western Washington defendent has been arrested and charged with conspiracy to murder in a foreign country in connection with the Tumbler Ridge mass shooting. https://t.co/aapsAMImh4

[Forensic OSINT @ForensicOsint]

How often have you scrolled a long page looking for one name?

Version 3.7.0 of the Forensic OSINT extension adds Keyword Alerts. I recorded a short walkthrough.

You add your case keywords once: names, usernames, aliases, whatever matters to the case. Then you browse as normal. When one of them appears on the page you are viewing, it shows up in the side panel.

✅ Add keywords in Case Management, or select a word on any page, right-click, and choose Add as case keyword
✅ See how many times each keyword matches on this page and across the session
✅ Jump to each hit, or Peek at the wording as it was displayed
✅ Pause scanning whenever you need to

The page itself is never changed. The panel sits beside it.

I find this most useful on long pages where a name is easy to scroll past. It does not replace reading the page. It tells you where to look first.

Also in this release: a dark theme. One setting covers the popup, the side panel and the Case Management System.

Give it a try and tell us what you think.

[Sean Carleton @SeanCarleton]

As this story goes viral, it's my responsibility as a residential school historian and expert on denialism to point out: the evidence about large numbers of child death and unmarked burials at residential school is already freely, publicly available: https://t.co/yKLstzEJwg

[Forensic OSINT @ForensicOsint]

I used to block out a morning to preserve a site by hand.

The judgment was never the slow part. The clicking was.

Scrolling every page. Expanding every comment thread. Keeping a tally of which pages I had already done and which ones I had missed.

Elite Assisted Capture takes the keystrokes. You review the list discovery returns, approve what is in scope, then observe and confirm each capture holds everything on your screen.

The judgment stays where it belongs. So does your ability to say exactly what you saw, and when you saw it.

✅ Website discovery and site intelligence: every plan, including Free
✅ Facebook, Instagram & LinkedIn timeline discovery: ELITE and above
✅ Capturing those pages and posts as evidence: Elite Assisted Capture
✅ Every capture hashed, timestamped and filed to the case

Elite Assisted Capture is $1,699 a year, or $159 a month, through 31 October. Subscribe by then, and you keep that rate for the life of the account. On 1 November, new subscriptions are $2,097 a year.

A tool that saves you a morning is only worth having if you can still account for every step it took.

[Google Earth @googleearth]

Learn how to use Google Earth's new change detection tool from the team that built it! https://t.co/9558PFUuFy

By applying this new capability to site analysis, Juan Francisco Saldarriaga will teach you how to use the tool and combine it with historical imagery to save time at work.

[Google Earth @googleearth]

Analyze sites with new tools in Google Earth. https://t.co/jeF9taTNIx

Every project starts with the same question: is this the right site? Now you can answer it in Google Earth, before resources are committed or field work begins.

• Detect change: See exactly where and when a site changed over time with a saveable heatmap.

• Terrain analysis tools: Evaluate elevation contours, slope, aspect, and cut and fill from your desk or the field, with point and click tools.

These tools are available on all Google Earth plans. Standard allows you to generate one layer with a tool each month. Professional plans include expanded access and capabilities when you need more tools, a larger site, or both.

Learn more: https://t.co/0HGyyqjmrx

[Forensic OSINT @ForensicOsint]

A blur on a satellite map tells you something is hidden. A fake forest lets you scroll right past.

Benjamin Strick on a Russian military site painted over on Yandex imagery, plus four more in this week's Friday 5.

🔗 https://t.co/WW2mAGHQoK

#OSINT #GEOINT