Being able to prove exactly when data was posted to the internet is a core skill for internet investigators. If you want to be able to prove when a video was first uploaded, when an account was created, or when an editorial change was made to a website, then you need to be able to …
Investigators are often faced with an overwhelming amount of data. In these situations finding an exact person, time, or place among all the noise can be very difficult. This problem is not limited to geo- or chronolocation challenges like those published by Quiztime either. Fortunately this is not a new problem and there are tried …
The Process of Elimination – Quiztime Jan 14th 2022 Read More »
Sometimes the way to solve a geolocation challenge is obvious. Other times less so. The Quiztime challenge that Fiete Stegers set on 8th October was certainly in the latter category and was probably the hardest Quiztime I’ve attempted so far. This is quite a lengthy write-up, so click to skip ahead to sections of interest. …
Ever since I started blogging about image geolocation I’ve tried to write about methods and techniques that make solving these kind of puzzles more structured and systematic. In my professional career I was (until recently) a criminal investigator so it was helpful for me to transfer habits and methodologies from traditional investigation to the subject …
Extract, Research, Verify: Quiztime 6th October 2020. Read More »
Twitter would not be Twitter without a daily dose of QAnon drama. Recently there were claims that since Q-drop archive site qmap.pub now shares the same IP as 8Kun proved that 8Kun owner Jim Watkins is Q. I’m not sure that a reverse IP lookup by itself can really stretch that far, but it does …
DNS Records, QAnon, and How To Handle Uncertainty In OSINT. Read More »
The term “OSINT” sometimes gets thrown around a little too loosely. The “open source” part of OSINT is straightfoward enough: there’s a world of information out there and with enough digging and practice you can find almost anything you could ever think of – but by itself this is not OSINT. The “intelligence” part of …
Website OSINT: What’s The Link Between Antifa.com and Russia? Read More »
Not all image-based OSINT work is about geolocation. It is always helpful to know where a photo was taken, but knowing when an image was taken can be just as important when trying to verify it. Is this a COVID-hit Italian hospital, or the aftermath of an earthquake in Croatia? Are these food packages left …
Using photographs for OSINT purposes is not new but almost all work of this kind mostly focuses on the visual content of images. Much less well known is the usefulness of image meta- and file data for research purposes. Beyond the visual appearance of an image there is often additional information hidden within an image …
In OSINT we make use of the wealth of information that is now available to us, but so often it becomes the case that there is too much information for us to process effectively. It’s easy to drown in a sea of data and you can quickly find yourself with twenty browser tabs open having …
Using Gap Analysis For Smarter OSINT – Quiztime 4th March 2020 Read More »
The last blog post I wrote about Fake Twitter profiles is by far the most widely-read post I’ve ever published since I started this blog. It’s nice when people read your work but there was a little sour note with this post after it was pointed out to me that someone had been posting it …
Who Stole My Stuff? Finding Out Who Is Behind A Website Read More »