One of the biggest challenges of internet investigation is preserving data once you’ve found it. We have access to more information than ever before, but so much of it can be easily lost if we don’t take steps to archive it. If you’ve ever bookmarked an important resource only to come back later and see …
There’s a huge difference between countries when it comes to using publicly available records for OSINT. If you’re researching a subject in the USA there’s a wealth of available information. In the EU it’s almost the opposite and it can be very difficult to find any public data at all. The UK is much more …
Ever since I started blogging about image geolocation I’ve tried to write about methods and techniques that make solving these kind of puzzles more structured and systematic. In my professional career I was (until recently) a criminal investigator so it was helpful for me to transfer habits and methodologies from traditional investigation to the subject …
Extract, Research, Verify: Quiztime 6th October 2020. Read More »
This article was written jointly with Matthias Wilson (@MWOSINT). It is also published on his own site here. IP addresses feature prominently in digital investigations, but how useful are they for geolocation? The truth is that while IP addresses have many investigative uses, they can be quite unreliable as a precise geolocation method. The limitations …
Hunchly is an excellent OSINT tool designed to capture and record your browser activity as you go. Once activated it sits quietly in the background as you browse and saves copies of webpages as you view them. It also records searches, captures EXIF data from images, takes screenshots, and saves lots of other useful data …
Using photographs for OSINT purposes is not new but almost all work of this kind mostly focuses on the visual content of images. Much less well known is the usefulness of image meta- and file data for research purposes. Beyond the visual appearance of an image there is often additional information hidden within an image …
A few months ago I wrote about how you could use Carbon-14 to detect the timestamps for images published in webpages. By comparing the publication times of the images with the publication time of the page itself it is possible to construct a timeline of when various elements in webpage were put together and so …
Website Forensics: How To Detect Editorial Changes Read More »
WordPress is the base that 35% of the world’s websites are built on. If you’re ever going to investigate a website, then it’s really important to be able to know your way around a WordPress setup. In this tutorial I’m going to show how to identify user accounts on a WordPress-based website so that you …
OSINT Techniques: Who’s Behind A WordPress Site? Read More »
Automation or Augmentation? Automation is an increasingly important part of OSINT. Even the simplest of investigations can require large amounts of different data types to be gathered and analysed quickly. Yet it is not accurate to suggest that all OSINT work is going to be automated as time progresses. Good OSINT practitioners will do …
Crypto Scam Investigation: Using Spiderfoot HX For OSINT Automation Read More »
Using OSINT to identify and investigate sources of malicious internet activity is a key part of cyber security. There’s a huge range of open source information out there to help with this, and Spiderfoot HX gathers it very quickly. This allows more time to spend on analysis of the data to help assess the nature …
Using Spiderfoot HX To Investigate A Malicious IP Address Read More »