Forensic OSINT

I watched a timeline capture run for 18 minutes. I never touched the mouse. 5-min walkthrough of Facebook Timeline Capture: set a date range, approve the post list, and each one opens with All comments expanded before it captures. 11 posts, 11 captured. #OSINT

So you want a career in OSINT? @OSINTtechniques wrote a short guide for @WHInspector, for teens and their mentors. Practice on puzzles, not people. Ask "should I?" before "can I?" 🔗 thewhitehatter.ca/post/so-yo…

Two satellite images, five days apart, one DC golf course. @bellingcat pairs Planet Labs captures from Oct 8 and Oct 13 to show the loss. 🔗 bellingcat.com/news/us-canad…

Forensic OSINT v3.8.1: a capture uses less CPU and memory while it runs. It no longer holds every screenshot in memory at once. A new Local Storage card under Settings shows what is on disk. forensicosint.com/whats-new #OSINT

Grok just told you who an account talks to. Did you open a single post to check? Nico Dekens (Dutch_OsintGuy) has started a new tip series on X with a practical one: mapping the footprint of one public X account. He practices on @NASA, so anyone can follow along. The method starts with no AI at all. You read the profile by hand first, so your first impression comes from the source, not a model summary. Then Advanced Search operators do the collection: ✅ from:NASA since:2026-09-01 until:2026-10-01 for a fixed window (until: is exclusive) ✅ to:NASA and @NASA -from:NASA for who is talking to the account ✅ min_faves and filter:media for what travels and what gets shared Grok sits on top as an accelerator. His rule for it is one I would tape to the monitor: no cited post URL, no finding. A Grok theme without three posts you confirmed yourself gets marked unverified. Posting hours get the same caution. They are clues, not geolocation. AI can speed up collection. The investigator decides when the evidence is enough. It is an X Article, so you will need to be logged in to X. Read Nico Dekens' full piece → xitter.twitterapi.xyz/dutch_osintguy/status/…

ADL has identified at least 8 mass attackers since 2024 who were active on one gore forum before they attacked. Its new piece explains memetic violence, where the attack is built to be content, and points to a field guide on the language. 🔗 linkedin.com/pulse/when-viol…

No cited post URL, no finding. Nico Dekens on using Grok to map an X account leads this week's Friday 5, plus Bellingcat's satellite pair, OPSEC, a due diligence story (fiction) and my career guide for teens and mentors. 🔗 forensicosint.com/newsletter #OSINT

Anyone can access public information. Making it something that can be "explained, reproduced and defended" is the work. The Canadian OSINT Centre's first white paper looks at why methodology matters for OSINT in Canada. 🔗 linkedin.com/posts/the-canad…

Forensic OSINT v3.8.1 is out. Elite Assisted Capture now covers Facebook, Instagram, TikTok, and LinkedIn. Facebook discovery is up to 5x faster. Sort and filter the list before you capture. forensicosint.com/whats-new #OSINT

I recorded this demo and kept thinking: I wish I had this years ago. It is a first look at Instagram Assisted Capture, coming soon to the Forensic OSINT extension. Capturing a profile properly means opening every post, expanding every comment thread and clicking through every photo in a carousel. Do that for a month of posts and the afternoon is gone. Meanwhile, posts and comments can be deleted at any time. In the video: ✅ Pick a date range and see which posts fall inside it ✅ Review the list, search it by keyword, export it to CSV ✅ Approve the posts and watch each one get opened, expanded and captured ✅ Check the case: comments loaded against the count Instagram reports, SHA-256 on every file Nothing is captured until you confirm. You can pause or stop at any point, and your job is to observe and confirm each capture. Capture will be part of the Elite Assisted Capture plan. Discovery is part of Elite. How much time would you save on your current captures?

One crawl returned an IBAN, a VAT number, and a regulator license. None of it was hidden. It sat in footers, terms pages, contact forms and PDFs, spread across pages nobody reads in order. On its own, each item is unremarkable. Together, they form a profile. Discovery pulls these out while it maps the site, on every plan including Free. ✅ Emails, phone numbers and postal addresses ✅ Crypto addresses, IBAN, SWIFT and payment accounts ✅ Company registrations, VAT and tax IDs, regulator licences ✅ Tracking IDs, subdomains, tech stack and shared infrastructure ✅ Documents and every external site linked For fraud work, the corporate identifiers matter most. A registration number gives you a real filing to pull. A regulator license either exists or it does not, and finding out is a search away. I gather these first because they point outward. They tell me which registry, which jurisdiction, which name to run next. Take the list wherever you already work. CSV or JSON, no capture required. See a full extraction → forensicosint.com/elite-assi… #OSINT #FraudInvestigation #OSINTTradecraft #ForensicOSINT #DueDiligence

A hash calculated an hour later says nothing about that hour. So it is computed as the file is written, with the time, timezone, browser, OS and version recorded alongside. 🔗 forensicosint.com/elite-assi…

Misuse is not uplift. The Soufan Center's new report documents how Islamic State and al-Qaeda supporters already use AI, from AI "news" dispatches to chatbot logs in a Vienna plot, and keeps that line clear. 🔗 thesoufancenter.org/wp-conte…

This forest near St Petersburg is fake. On Yandex it is edited over a Russian military site that Yle first reported. Benjamin Strick shows how to check: repeated shadow shapes, then Google Earth and Esri Wayback history. 🔗 youtube.com/watch?v=Hg5MeWTT…

I used to block out a morning to preserve a site by hand. The judgment was never the slow part. The clicking was. Scrolling every page. Expanding every comment thread. Keeping a tally of which pages I had already done and which ones I had missed. Elite Assisted Capture takes the keystrokes. You review the list discovery returns, approve what is in scope, then observe and confirm each capture holds everything on your screen. The judgment stays where it belongs. So does your ability to say exactly what you saw, and when you saw it. ✅ Website discovery and site intelligence: every plan, including Free ✅ Facebook, Instagram & LinkedIn timeline discovery: ELITE and above ✅ Capturing those pages and posts as evidence: Elite Assisted Capture ✅ Every capture hashed, timestamped and filed to the case Elite Assisted Capture is $1,699 a year, or $159 a month, through 31 October. Subscribe by then, and you keep that rate for the life of the account. On 1 November, new subscriptions are $2,097 a year. A tool that saves you a morning is only worth having if you can still account for every step it took.

How often have you scrolled a long page looking for one name? Version 3.7.0 of the Forensic OSINT extension adds Keyword Alerts. I recorded a short walkthrough. You add your case keywords once: names, usernames, aliases, whatever matters to the case. Then you browse as normal. When one of them appears on the page you are viewing, it shows up in the side panel. ✅ Add keywords in Case Management, or select a word on any page, right-click, and choose Add as case keyword ✅ See how many times each keyword matches on this page and across the session ✅ Jump to each hit, or Peek at the wording as it was displayed ✅ Pause scanning whenever you need to The page itself is never changed. The panel sits beside it. I find this most useful on long pages where a name is easy to scroll past. It does not replace reading the page. It tells you where to look first. Also in this release: a dark theme. One setting covers the popup, the side panel and the Case Management System. Give it a try and tell us what you think.

A blur on a satellite map tells you something is hidden. A fake forest lets you scroll right past. Benjamin Strick on a Russian military site painted over on Yandex imagery, plus four more in this week's Friday 5. 🔗 forensicosint.com/newsletter #OSINT #GEOINT

When a client needs something we do not do yet, we build it. A client asked whether Forensic OSINT could capture LinkedIn endorsements. The honest answer was no. The full list of endorsers was out of reach. Our dev team picked it up the same day. The video is the prototype on a live profile. Here is how these requests work. ✅ You tell us what you need to capture, and where ✅ You get a working prototype to use on your case right away ✅ It ships to everyone in a main product release once it is ready For this one, the prototype adds an Export Endorsements to CSV button. Each row is one endorser, with name, connection degree, headline and profile URL. The run in the video produced 213 rows from a single capture, with every file SHA-256 hashed. You still check the capture before you rely on it. The prototype does not change that. If a platform is blocking your collection, send it our way.

OCCRP's research director shares how her team builds a profile from one clue. Archive first. Look abroad when a registry is closed. Find the relative who posts publicly. Treat every people-search hit as a lead, not proof. 🔗 occrp.org/en/feature/reporte…

A wicker chair in a Telegram video was the first clue. ProPublica would not publish on that alone. The proof: a guest's Instagram group photo, with Umar Kremlev in the back row at Trump Jr.'s wedding weekend. 🔗 propublica.org/article/donal…

The wedding photos were curated. A guest's Instagram was not, and a Russian oligarch was in the back row. That, a Kinahan visa record checked twice, and OCCRP's playbook for finding people who hide. This week's Friday 5. 🔗 forensicosint.com/newsletter