Forensic OSINT

Coming this summer to Forensic OSINT: Subject Monitoring & Change Alerts. → Register any public profile or web page → Set polling from every 10 min to daily → Get alerted on new posts, edits, deletions, and username changes → One-click forensic capture from the alert Spring promo subscribers lock in +50% poll budget. 4,500/month instead of 3,000. Permanently. Never expires. forensicosint.com/spring

After an incident, everyone looks back. The warning signs were there. A post at 9 PM the night before. Specific language. Specific intent. It was public. It was visible. Anyone could have seen it. But nobody was watching that profile at 9 PM. The post was deleted by midnight. By the time investigators got involved the next day, it was gone. The only reason anyone knew about it was that someone remembered seeing it in their feed. A memory is not evidence. This is the scenario that keeps investigators up at night. Not the evidence you lost. The evidence you never knew existed. Subject Monitoring won't solve every case. But it watches when you can't. Public profiles. Scheduled checks. Automated alerts. You get notified. You go capture. You preserve the evidence. forensicosint.com/spring #OSINT #ForensicOSINT #DigitalForensics

Even when someone tries to hide online, their social network gives them away. Kirby Plessas published the full methodology behind her Friend Overlap tool. Compare two accounts. If they share many of the same connections, there's a strong chance they belong to the same person. Scale it across platforms, and the patterns become an identity fingerprint. What it can surface: ✅ Alternate accounts behind different usernames ✅ Cross-platform identities across IG, X, TikTok ✅ Hidden friend lists reconstructed through friends-of-friends ✅ Pseudonyms where the persona changed but the network didn't Privacy settings hide content. They rarely hide structure. And structure is often enough. Full methodology: plessas.net/blog/2026/4/7/… Want more like this? The Forensic OSINT Friday 5 is free. 📩 forensicosint.com/newsletter

Your subject posted something at 2 AM. By 11 AM, it was deleted. You found out at 3 PM. By then, it was gone. No screenshot. No capture. No evidence that it ever existed. You can't monitor every profile 24/7. You have cases to work. Reports to write. A life outside the screen. But what if something was watching for you? That's what we're building. Subject Monitoring tracks any public profile on a schedule you set. Every 10 minutes. Every hour. Daily. When something changes, you get notified. New post. Deleted post. Edited content. Username change. Profile update. You don't have to be watching. The system is watching for you. Coming this summer to Forensic OSINT. Spring promo subscribers lock in +50% monitoring capacity. Permanently. 4,500 polls/month instead of 3,000. forensicosint.com/spring How many times has key evidence disappeared before you even knew it existed? #OSINT #ForensicOSINT #DigitalForensics

AI can only be trained on tasks where you can tell if the answer is right or wrong. Chess. Code. Translation. But most of what expert analysts do has no clean, correct answer to check against. Jacob H at OSINT Combine breaks it down: ✅ Inductive reasoning (what AI does well) — patterns in data. Geolocation, translation, entity extraction. ✅ Abductive reasoning (what defines good analysis) — the best explanation from an incomplete picture. Recognizing that silence is itself a signal. Two underappreciated judgment calls right now: ✅ Knowing when to start — which questions, in which order ✅ Knowing when to stop — there's always more to collect A 2025 MIT study is worth noting. EEG scans showed that AI-assisted writers had the weakest neural engagement among all groups tested. 83% couldn't recall a sentence from their own writing 60 seconds later. The researchers called it "cognitive debt." The 90% of OSINT that depends on human judgment isn't a temporary gap waiting for the next model release. It's structural. Full article: osintcombine.com/post/human-jud… Want more like this? The Forensic OSINT Friday 5 is free. 📩 forensicosint.com/newsletter

China has a social platform with 300M monthly users. Most Western investigators have never touched it. It's called Xiaohongshu (Little Red Book) — and a rape victim's warning posted there led to a serial predator's conviction in London. @bellingcat dropped a practical OSINT guide. The key points: ✅ Search in Chinese, not English. English shows a curated bubble. ✅ Censored content is a lead. Blanked-out posts and coded language signal where the sensitive conversations live. ✅ Track by unique ID, not username. Display names change. The ID doesn't. ✅ Capture fast — content disappears. The barrier is language, not access. And if you don't know which emojis substitute for sensitive terms, you'll misread entire threads. A native speaker isn't optional for serious work here. Full guide: bellingcat.com/resources/2026… Want more like this? The Forensic OSINT Friday 5 is free. 📩 forensicosint.com/newsletter

Seven hours of manual research. 300+ declassified PDFs. Zero AI shortcuts. Matthias Wilson went deep into NRO documents to write a verified history of early U.S. SIGINT satellites. His conclusion after testing ChatGPT on the same task? AI wasn't even close. The methodology is the real lesson here. 🔗 linkedin.com/pulse/covert-s…

The person who gets arrested is rarely the whole story. They're usually just the part we can still see. @dutch_osintguy breaks down the seven-phase pipeline from online radicalization to physical action — and where OSINT collection actually matters most. One of the most important reads this year for analysts working on extremism cases. 🔗 dutchosintguy.com/post/from-open…

AI agents don't solve the OSINT verification problem. They compress collection and structuring so analysts can spend time on what actually requires judgment. Ismael Alv worked through a full 6-step AI agent workflow for crisis response, and it's one of the better operational breakdowns I've seen. 🔗 lnkd.in/g_ztsADx

@d3ck4rd_ Still refining it. ;)

@ForensicOsint Hi ! This is great ! The username search doesn't seem to work with Snapchat currently

We just released a free OSINT toolkit for investigators. IP Lookup (VPN/proxy detection + court-ready PDF) Username Search (600+ sites) Domain-to-IP with security scoring Email Header Analyzer Image EXIF Reader Timestamp Decoder Try instantly. Free account for ongoing access. No search data tracked.

Most people give up when all they see is sand. Benjamin S. (linkedin.com/in/bendobrown/) used it to solve the case. He geolocated Taliban special forces drills in a featureless Afghan desert using only sand dunes as reference points. By applying geo-profiling, he started wide → Kandahar Airfield → drop-off point → finally pinpointed the exact dune that was bombed. Instead of hunting the “exact spot” first, he mapped the broader environment and let the terrain guide him in. 💡 Key takeaway: When the target vanishes, map the surroundings first. Let nearby terrain anchors lead you to the truth. Check the full breakdown here: lnkd.in/gBCgumwF Want more OSINT gems like this? Subscribe to the Forensic OSINT Friday 5 Roundup – it's FREE! 📩 lnkd.in/ghhZwpZ8

Courts have gotten IP geolocation wrong. An IP address is not a GPS coordinate. It resolves to network infrastructure, not a person's location. People have had their homes raided over this misunderstanding. Our free IP Lookup report explains exactly what the data means and what it doesn't. Digitally signed, SHA-256 hashed, built for disclosure.

You get a legal return from a social media platform. Dozens of IP addresses are buried across pages of session data. Miss one? Transpose a digit? That's a lost lead or a wrong address. Our IP Lookup tool parses the entire document and extracts every IPv4 and IPv6 automatically. 100% client-side. Your sensitive material never leaves your browser. forensicosint.com/free-tools

@ForensicOsint Does the link I share to an X post also identify me? Or is the post link global

That long number in an X post URL? It's a Snowflake ID. It encodes the exact date and time the post was created. Even if the post is deleted, the URL tells you when it was published. Our free Timestamp Decoder instantly extracts it. But paste in the page source code, and it goes deeper. One Facebook page returned 853 hidden timestamps across the source. Server times, creation dates, and authentication tokens. Dates that never appear on screen. 100% client-side. Nothing leaves your browser.

@CounterTheFraud @grok We are happy you like it. Always smart to be cautious of links. Smart move.

@ForensicOsint @grok Honestly I'm skeptical of any links to websites, but once grok confirmed it was legit I was like, I gotta check this out. It's definitely forensic OSINT that's for sure, it collects the evidence chain easily.

Thanks @grok for confirming! 😉

@iamTiresias Is there any tool you think we are missing that you'd like to see @iamTiresias ?

Good addition to the free OSINT toolkit space. The combination of IP analysis + username enumeration + email header parsing in one place saves tab-juggling for initial recon phases. If you're building investigation workflows or comparing free vs paid OSINT tools, let's connect. Always useful to hear what's working for other practitioners in the field