Skip to content

Roadmap

OSINT Investigator

Structured, defensible research using public information: method, source discipline, verification and reporting about people and infrastructure.

Beginner → Intermediate6 stages5–8 weeks

Prerequisites

  • Careful note-taking
  • Comfort with a browser and a shell

Who it is for

Analysts, journalists, defenders, anyone doing public-record research

Outcome: You can run a repeatable research process, distinguish corroboration from coincidence, and document findings so a third party can retrace them.

Stages

Work them in order the first time. Ticking a stage only records your own progress, in this browser.

Progress0 / 60%

Stored in this browser only. No account, no sync.

  1. Method before tools

    Questions, hypotheses, and the difference between an indicator and a conclusion.

    4 hours

    Learn

    • Writing a research question
    • Source hierarchy and freshness
    • Confirmation bias in correlation work

    Do

    • Document one negative result and why it does not prove absence.

  2. Identifiers and handles

    How usernames behave across platforms, and why automated checks mislead.

    1 week

    Learn

    • False positives from status codes
    • Registration dates and profile text

    Do

    • Run a handle search, then manually confirm three results in a browser.
    • List two ways a 200 response can be meaningless.
    ToolsSherlock

  3. Domains and infrastructure

    Certificate transparency, DNS records and WHOIS as durable public records.

    1 week

    Learn

    Do

    • Build a subname list from two independent sources and diff them.
    • Record which source produced each name.
    ToolsSubfindertheHarvester

  4. Files and metadata

    What documents and images carry with them, and how to verify a claim of origin.

    1 week

    Learn

    • EXIF, XMP and document properties
    • Sanitising before publication

    Do

    • Strip metadata from a copy of your own photo and verify.
    • Write the caveat that metadata never proves authorship.
    ToolsExifTool

  5. Correlation and link analysis

    Model relationships explicitly so an inference is visible as an inference.

    1 week

    Learn

    • Entities, links, confidence levels
    • Reporting uncertainty

    Do

    • Draw a five-node graph of a case and label each edge's evidence.
    ToolsSpiderFoot

  6. Legality, ethics and retention

    Public does not mean permissible to use. Data minimisation, purpose limitation, deletion.

    3–5 hours

    Learn

    Do

    • Write the retention rule you would apply to your own research output.

Tools in this path

Each tool page carries installation steps, commands and the errors you will hit.

All roadmapsNext path: Web Pentester