Forensic OSINT

- Chrome Extension for OSINT Web Capture
- Capture Evidence Quickly Before It Disappears
- Includes: OSINT Knowledge base, Video Download and Data Insights!

[Forensic OSINT @ForensicOsint]

🎥 A Client Question Worth Sharing: How to Download a Video from Threads

A subscriber reached out this week with a problem: our Forensic OSINT Video Downloader supports most major social platforms, but Threads isn't one of them yet.

They had a video they needed to preserve — and couldn't wait for us to ship support.

So we walked them through a manual workaround using nothing but Chrome. Sharing it here in case anyone else is in the same spot.

We're always here to help our subscribers, whether the tool covers it or not.

⚙️ 𝗧𝗵𝗲 𝘄𝗼𝗿𝗸𝗳𝗹𝗼𝘄 — 𝗮𝗯𝗼𝘂𝘁 𝟮𝟬 𝘀𝗲𝗰𝗼𝗻𝗱𝘀:

1️⃣ Open the Threads post in Chrome.
2️⃣ Open DevTools → three-dot menu → More tools → Developer tools (or F12).
3️⃣ Go to the Network tab, click the Media filter.
4️⃣ Reload the page (Ctrl + R). Network only captures requests made after it's open.
5️⃣ A single .mp4 file will appear. That's it.
6️⃣ Click the file name to open the raw video in a new tab.
7️⃣ Right-click → "Save video as..." Done.

✅ No extensions, no sketchy third-party sites, no malware risk.

⚠️ 𝗢𝗻𝗲 𝗶𝗺𝗽𝗼𝗿𝘁𝗮𝗻𝘁 𝗰𝗮𝘃𝗲𝗮𝘁:
This gets you the file. That's it. No chain of custody, no timestamp, no hash, no proof of where it came from or when. For personal use, fine. For an investigation, not enough.

🛡️ 𝗜𝗳 𝘆𝗼𝘂 𝗵𝗮𝘃𝗲 𝘁𝗼 𝘂𝘀𝗲 𝘁𝗵𝗶𝘀 𝗺𝗲𝘁𝗵𝗼𝗱, 𝗺𝗮𝗸𝗲 𝗶𝘁 𝗱𝗲𝗳𝗲𝗻𝘀𝗶𝗯𝗹𝗲:

🔐 Hash the file immediately (SHA-256).

Windows: Get-FileHash video.mp4.
Mac/Linux: shasum -a 256 video.mp4.

📝 Document contemporaneously — write notes as you go, not after. Capture full URL, date/time with timezone, username, post ID, view count.

📸 Screenshot the page, the DevTools Network panel showing the .mp4 request, and the source URL bar.

💻 Note your environment — browser version, OS, your name, reason for capture.

🗂️ Preserve the original untouched. Work from copies.

Done right, this gives you a defensible record proving how the video was obtained and that it hasn't been altered since capture.

⏱️ But it's manual, error-prone, and time-consuming. Miss a step and the evidence may not hold up.

🎯 𝗧𝗵𝗮𝘁'𝘀 𝘁𝗵𝗲 𝗴𝗮𝗽 𝗼𝘂𝗿 𝗩𝗶𝗱𝗲𝗼 𝗗𝗼𝘄𝗻𝗹𝗼𝗮𝗱𝗲𝗿 𝗳𝗶𝗹𝗹𝘀.

Every download generates a Video Evidence Continuity Report — a single-page, digitally signed and timestamped PDF including:

👤 Who captured it, what, when, and how
🔗 Full source URL and platform metadata
#️⃣ SHA-256 hash of the video file
🖼️ 10 screen captures from the video as a visual reference
🕓 Trusted timestamp anchoring the exact capture moment

Everything needed to establish authenticity and chain of custody — automatically, every time.

We support most major social platforms, and Threads is on the roadmap. Until then, follow the manual steps above. For everything else, let us handle it.

[Forensic OSINT @ForensicOsint]

Video Evidence Continuity Report (PDF)

[Forensic OSINT @ForensicOsint]

🎥 A Client Question Worth Sharing: How to Download a Video from Threads

A subscriber reached out this week with a problem: our Forensic OSINT Video Downloader supports most major social platforms, but Threads isn't one of them yet.

They had a video they needed to preserve — and couldn't wait for us to ship support.

So we walked them through a manual workaround using nothing but Chrome. Sharing it here in case anyone else is in the same spot.

We're always here to help our subscribers, whether the tool covers it or not.

⚙️ 𝗧𝗵𝗲 𝘄𝗼𝗿𝗸𝗳𝗹𝗼𝘄 — 𝗮𝗯𝗼𝘂𝘁 𝟮�� 𝘀𝗲𝗰𝗼𝗻𝗱𝘀:

1️⃣ Open the Threads post in Chrome.
2️⃣ Open DevTools → three-dot menu → More tools → Developer tools (or F12).
3️⃣ Go to the Network tab, click the Media filter.
4️⃣ Reload the page (Ctrl + R). Network only captures requests made after it's open.
5️⃣ A single .mp4 file will appear. That's it.
6️⃣ Click the file name to open the raw video in a new tab.
7️⃣ Right-click → "Save video as..." Done.

✅ No extensions, no sketchy third-party sites, no malware risk.

⚠️ 𝗢𝗻𝗲 𝗶𝗺𝗽𝗼𝗿𝘁𝗮𝗻𝘁 𝗰𝗮𝘃𝗲𝗮𝘁:
This gets you the file. That's it. No chain of custody, no timestamp, no hash, no proof of where it came from or when. For personal use, fine. For an investigation, not enough.

🛡️ 𝗜𝗳 𝘆𝗼𝘂 𝗵𝗮𝘃𝗲 𝘁𝗼 𝘂𝘀𝗲 𝘁𝗵𝗶𝘀 𝗺𝗲𝘁𝗵𝗼𝗱, 𝗺𝗮𝗸𝗲 𝗶𝘁 𝗱𝗲𝗳𝗲𝗻𝘀𝗶𝗯𝗹𝗲:

🔐 Hash the file immediately (SHA-256).

Windows: Get-FileHash video.mp4.
Mac/Linux: shasum -a 256 video.mp4.

📝 Document contemporaneously — write notes as you go, not after. Capture full URL, date/time with timezone, username, post ID, view count.

📸 Screenshot the page, the DevTools Network panel showing the .mp4 request, and the source URL bar.

💻 Note your environment — browser version, OS, your name, reason for capture.

🗂️ Preserve the original untouched. Work from copies.

Done right, this gives you a defensible record proving how the video was obtained and that it hasn't been altered since capture.

⏱️ But it's manual, error-prone, and time-consuming. Miss a step and the evidence may not hold up.

🎯 𝗧𝗵𝗮𝘁'𝘀 𝘁𝗵𝗲 𝗴𝗮𝗽 𝗼𝘂𝗿 𝗩𝗶𝗱𝗲𝗼 𝗗𝗼𝘄𝗻𝗹𝗼𝗮𝗱𝗲𝗿 𝗳𝗶𝗹𝗹𝘀.

Every download generates a Video Evidence Continuity Report — a single-page, digitally signed and timestamped PDF including:

👤 Who captured it, what, when, and how
🔗 Full source URL and platform metadata
#️⃣ SHA-256 hash of the video file
🖼️ 10 screen captures from the video as a visual reference
🕓 Trusted timestamp anchoring the exact capture moment

Everything needed to establish authenticity and chain of custody — automatically, every time.

We support most major social platforms, and Threads is on the roadmap. Until then, follow the manual steps above. For everything else, let us handle it.

[Forensic OSINT @ForensicOsint]

After an incident, everyone looks back.

The warning signs were there.

A post at 9 PM the night before. Specific language. Specific intent.

It was public. It was visible. Anyone could have seen it.

But nobody was watching that profile at 9 PM.

The post was deleted by midnight.

By the time investigators got involved the next day, it was gone. The only reason anyone knew about it was that someone remembered seeing it in their feed.

A memory is not evidence.

This is the scenario that keeps investigators up at night. Not the evidence you lost. The evidence you never knew existed.

Subject Monitoring won't solve every case. But it watches when you can't.

Public profiles. Scheduled checks. Automated alerts.

You get notified. You go capture. You preserve the evidence.

https://t.co/8n7Q7i1aHp

#OSINT #ForensicOSINT #DigitalForensics

[Forensic OSINT @ForensicOsint]

Even when someone tries to hide online, their social network gives them away.

Kirby Plessas published the full methodology behind her Friend Overlap tool.

Compare two accounts. If they share many of the same connections, there's a strong chance they belong to the same person.

Scale it across platforms, and the patterns become an identity fingerprint.

What it can surface:
✅ Alternate accounts behind different usernames
✅ Cross-platform identities across IG, X, TikTok
✅ Hidden friend lists reconstructed through friends-of-friends
✅ Pseudonyms where the persona changed but the network didn't
Privacy settings hide content. They rarely hide structure.
And structure is often enough.

Full methodology:
https://t.co/ooRglhWxga

Want more like this?
The Forensic OSINT Friday 5 is free.
📩 https://t.co/WwFzhYh2OA

[Forensic OSINT @ForensicOsint]

Your subject posted something at 2 AM.
By 11 AM, it was deleted.

You found out at 3 PM. By then, it was gone.

No screenshot. No capture. No evidence that it ever existed.

You can't monitor every profile 24/7. You have cases to work. Reports to write. A life outside the screen.

But what if something was watching for you?

That's what we're building.

Subject Monitoring tracks any public profile on a schedule you set.
Every 10 minutes. Every hour. Daily.

When something changes, you get notified.

New post. Deleted post. Edited content. Username change. Profile update.

You don't have to be watching. The system is watching for you.

Coming this summer to Forensic OSINT.

Spring promo subscribers lock in +50% monitoring capacity. Permanently. 4,500 polls/month instead of 3,000.

https://t.co/8n7Q7i1aHp

How many times has key evidence disappeared before you even knew it existed?

#OSINT #ForensicOSINT #DigitalForensics

[Forensic OSINT @ForensicOsint]

AI can only be trained on tasks where you can tell if the answer is right or wrong.
Chess. Code. Translation.

But most of what expert analysts do has no clean, correct answer to check against.

Jacob H at OSINT Combine breaks it down:

✅ Inductive reasoning (what AI does well) — patterns in data. Geolocation, translation, entity extraction.

✅ Abductive reasoning (what defines good analysis) — the best explanation from an incomplete picture. Recognizing that silence is itself a signal.

Two underappreciated judgment calls right now:

✅ Knowing when to start — which questions, in which order

✅ Knowing when to stop — there's always more to collect

A 2025 MIT study is worth noting. EEG scans showed that AI-assisted writers had the weakest neural engagement among all groups tested. 83% couldn't recall a sentence from their own writing 60 seconds later.

The researchers called it "cognitive debt."

The 90% of OSINT that depends on human judgment isn't a temporary gap waiting for the next model release. It's structural.

Full article:
https://t.co/L3gucoId5X

Want more like this? The Forensic OSINT Friday 5 is free.
📩 https://t.co/WwFzhYh2OA

[Forensic OSINT @ForensicOsint]

China has a social platform with 300M monthly users.
Most Western investigators have never touched it.
It's called Xiaohongshu (Little Red Book) — and a rape victim's warning posted there led to a serial predator's conviction in London.

@bellingcat dropped a practical OSINT guide. The key points:

✅ Search in Chinese, not English. English shows a curated bubble.

✅ Censored content is a lead. Blanked-out posts and coded language signal where the sensitive conversations live.

✅ Track by unique ID, not username. Display names change. The ID doesn't.

✅ Capture fast — content disappears.

The barrier is language, not access. And if you don't know which emojis substitute for sensitive terms, you'll misread entire threads.

A native speaker isn't optional for serious work here.

Full guide: https://t.co/FAnjaKyQlR

Want more like this? The Forensic OSINT Friday 5 is free.
📩 https://t.co/WwFzhYh2OA

[Forensic OSINT @ForensicOsint]

Coming this summer to Forensic OSINT:

Subject Monitoring & Change Alerts.

→ Register any public profile or web page
→ Set polling from every 10 min to daily
→ Get alerted on new posts, edits, deletions, and username changes
→ One-click forensic capture from the alert

Spring promo subscribers lock in +50% poll budget. 4,500/month instead of 3,000.

Permanently. Never expires.

https://t.co/8n7Q7i1aHp

[Forensic OSINT @ForensicOsint]

Seven hours of manual research. 300+ declassified PDFs. Zero AI shortcuts.

Matthias Wilson went deep into NRO documents to write a verified history of early U.S. SIGINT satellites. His conclusion after testing ChatGPT on the same task? AI wasn't even close.

The methodology is the real lesson here.

🔗 https://t.co/ew8NF3lOws

[Forensic OSINT @ForensicOsint]

The person who gets arrested is rarely the whole story. They're usually just the part we can still see.

@dutch_osintguy breaks down the seven-phase pipeline from online radicalization to physical action — and where OSINT collection actually matters most.

One of the most important reads this year for analysts working on extremism cases.

🔗 https://t.co/k932cOhnJW

[Forensic OSINT @ForensicOsint]

AI agents don't solve the OSINT verification problem.

They compress collection and structuring so analysts can spend time on what actually requires judgment.

Ismael Alv worked through a full 6-step AI agent workflow for crisis response, and it's one of the better operational breakdowns I've seen.

🔗 https://t.co/T7eCW6AFcW

[Forensic OSINT @ForensicOsint]

@d3ck4rd_ Still refining it. ;)

[Forensic OSINT @ForensicOsint]

We just released a free OSINT toolkit for investigators.

IP Lookup (VPN/proxy detection + court-ready PDF)
Username Search (600+ sites)
Domain-to-IP with security scoring
Email Header Analyzer
Image EXIF Reader
Timestamp Decoder

Try instantly. Free account for ongoing access. No search data tracked.

[Forensic OSINT @ForensicOsint]

Most people give up when all they see is sand.
Benjamin S. (https://t.co/q8dG5sicIT) used it to solve the case.

He geolocated Taliban special forces drills in a featureless Afghan desert using only sand dunes as reference points.

By applying geo-profiling, he started wide → Kandahar Airfield → drop-off point → finally pinpointed the exact dune that was bombed.

Instead of hunting the “exact spot” first, he mapped the broader environment and let the terrain guide him in.

💡 Key takeaway: When the target vanishes, map the surroundings first. Let nearby terrain anchors lead you to the truth.

Check the full breakdown here: https://t.co/okKYrADADE

Want more OSINT gems like this? Subscribe to the Forensic OSINT Friday 5 Roundup – it's FREE! 📩 https://t.co/wUHwNmAvTY

[Forensic OSINT @ForensicOsint]

https://t.co/bARazGXad6

[Forensic OSINT @ForensicOsint]

Courts have gotten IP geolocation wrong. An IP address is not a GPS coordinate.

It resolves to network infrastructure, not a person's location.

People have had their homes raided over this misunderstanding.

Our free IP Lookup report explains exactly what the data means and what it doesn't. Digitally signed, SHA-256 hashed, built for disclosure.

[Forensic OSINT @ForensicOsint]

You get a legal return from a social media platform. Dozens of IP addresses are buried across pages of session data.

Miss one? Transpose a digit?
That's a lost lead or a wrong address.

Our IP Lookup tool parses the entire document and extracts every IPv4 and IPv6 automatically.

100% client-side.
Your sensitive material never leaves your browser.

https://t.co/8BRWR4T23d

[Forensic OSINT @ForensicOsint]

@b03sm4n

[Forensic OSINT @ForensicOsint]

That long number in an X post URL?
It's a Snowflake ID.
It encodes the exact date and time the post was created. Even if the post is deleted, the URL tells you when it was published.

Our free Timestamp Decoder instantly extracts it.

But paste in the page source code, and it goes deeper.

One Facebook page returned 853 hidden timestamps across the source.

Server times, creation dates, and authentication tokens. Dates that never appear on screen.

100% client-side. Nothing leaves your browser.

[Forensic OSINT @ForensicOsint]

@CounterTheFraud @grok We are happy you like it. Always smart to be cautious of links. Smart move.

[Forensic OSINT @ForensicOsint]

Thanks @grok for confirming! 😉

[Forensic OSINT @ForensicOsint]

@iamTiresias Is there any tool you think we are missing that you'd like to see @iamTiresias ?