OSINT basics: what investigators actually do
Open-source intelligence sounds mysterious until you watch someone do it well. Then it looks almost boring: one careful question after another, each answer pointing to the next question. The skill isn't secret tools. It's knowing what to ask and how to pivot.
The one-sentence definition
OSINT is collecting and analyzing information that is legally and publicly available, and turning it into an answer to a specific question. The "open source" part doesn't mean software. It means sources anyone could access: search engines, social media, public records, archived pages, leaked-in-the-sense-of-already-public documents.
That definition carries two consequences people skip. First, the question matters more than the tools. "Find everything about John" is not an investigation, it's hoarding. "Did this company's employee list change after the acquisition?" is one. Second, public does not mean free to exploit. What you can legally collect is much wider than what you can legally use, especially once personal data is involved.
Pivoting is the whole game
New investigators search for a person. Experienced investigators collect identifiers and pivot between them. Every piece of information is potentially an entry point to three more:
| You have | You can often derive |
|---|---|
| Email address | Breach appearances, linked accounts, gravatar images, username pattern |
| Username | Accounts on other platforms (people reuse names), posting patterns, timezone |
| A photo | Location clues, other sites it appeared on (reverse image search), embedded metadata |
| A domain | Subdomains, certificate history, registration records, related domains, old versions |
| A phone number | Carrier/country, whether it's registered on messaging apps, business listings |
Draw your findings as a graph, not a list. The case isn't solved when you have lots of data; it's solved when the connections answer the question you started with.
Tools worth learning (and what they're actually for)
- Google (and dorks) — still the highest-yield source. Learn the operators in our dorking guide.
- Yandex Images / Google Lens — reverse image search. Yandex is often stronger for faces and places; Lens for objects and text.
- ExifTool — the standard for reading file metadata. One command, endless value:
exiftool file.jpg. - WhatsMyName (whatsmyname.app) — checks a username across hundreds of platforms. Same idea as the Sherlock tool, but hosted.
- HaveIBeenPwned — which breaches an email appears in. Breach data often exposes the username patterns people reuse.
- crt.sh — certificate transparency logs. Type a domain, get subdomains the owner forgot existed.
- Shodan — search engine for internet-connected devices and services. More for infrastructure work than people work.
- Wayback Machine — deleted pages rarely stay deleted. Old versions of a site often contain what someone removed.
Investigator OPSEC: don't become the data point
- Use dedicated research accounts for anything that requires logging in. Your personal profile attached to your queries tells the target exactly who is looking.
- Don't interact. Following, liking, or contacting a subject changes their behavior and your legal position. Observation only, unless the engagement is the task.
- Mind your own trail. Logged-out social viewing, VPNs where appropriate, and no reuse of your research username anywhere personal.
- Log everything. Screenshots with timestamps, the query you ran, the URL you found it at. An unverified finding you can't reproduce is worth nothing.
The ethics line, plainly
Collecting what's public is generally fine. Accessing things through someone's password, buying leaked data, or assembling profiles to harass someone is not, and several of those are crimes regardless of "it was all public". Two questions keep you clean: would the source mind that I'm reading this, and does my use of this data respect the person it describes? If an answer is unclear, stop and think, or ask someone who knows the law where you live.
Learn it by doing it
Reading builds vocabulary; only casework builds instinct. CipherPoint's challenges are safe, synthetic investigations: real techniques, fictional targets, and a scoring system that tells you when you found the right thread.
Start with an easy case and your first pivot.
Try a challenge