This article was originally published on the AutomatingOSINT.com blog. Welcome back! In this series of blog posts we are wrapping the awesome OnionScan tool and then analyzing the data that falls out of it. If you haven’t read parts one and two in this series then you should go do that first. In this post we […]

When most people think about open source research, they think about uncovering social media materials of soldiers on the front-lines of the wars in Ukraine and Syria, or geolocating video footage of significant events with Google Earth. While open source materials have led a mini-revolution in how conflicts are reported online, there is another area where there […]

This article was originally posted on the AutomatingOSINT.com blog. Welcome back to the fourth and final instalment in this series. If you haven’t read part one, two or three definitely feel free to go and do so. This will be much shorter than the others The original inspiration for this post was from a @krypti3a blog […]

This article was originally posted at the AutomatingOSINT.com blog. Not long ago I was intrigued by the Oct282011.com Internet mystery (if you haven’t heard of it check out this podcast). Friends of the Hunchly mailing list and myself embarked on a brief journey to see if we could root out any additional clues or, of […]

Internet shutdowns happen - more frequently than we often hear. An impressive 56 countrywide shutdowns were documented in 2016, according to Access Now’s campaign #KeepItOn, which also defines a shutdown as “an intentional disruption of internet or electronic communications, rendering them inaccessible or effectively unusable, for a specific population or within a location, often to exert control over the flow of information.”

This article was originally posted on the AutomatingOSINT.com blog. Having an early warning system is an incredibly useful tool in the OSINT world. Being able to monitor search engines and other sites for keywords, IP addresses, document names, or email addresses is extremely useful. This can tell you if an adversary, competitor or a friendly […]

The research behind the joint report with Transparency International was only made possible due to the government’s decision in 2014 to make its records available to the public free of charge.   Due to the volume of Scottish Limited Partnerships (“SLPs”) incorporated during 2016 this information would have previously cost thousands of pounds. A similar investigation […]

One of the most common issues for researchers and journalists is verifying user-generated video content, most often found on social networks and file sharing platforms, such as YouTube, Twitter, Facebook, and so on. There is no silver bullet to verify every video, and it may be nearly impossible to verify some videos short of acquiring […]

Quick links: Article cards – Full list – Raw spreadsheet In January of 2017, CIA made the entirety of their declassified records collection available online. Previously, only select documents were available through the online collection, with the rest available only through National Archives at College Park, Maryland. Thus, for researchers of intelligence such as myself, […]

This post was originally posted on the AutomatingOSINT.com blog here.A few years ago Lawrence Alexander published a great piece on finding connections between websites using Google Analytics (among others) codes. Last year I had published a post where I taught you how to automatically mine some of this information using Python, and then how to visualize it. Unfortunately the […]

This article was originally posted to the AutomatingOSINT.com blog. More and more investigations are being conducted on Tor and many of them can also include investigating Bitcoin transactions. The nature of Bitcoin is such that the transactions themselves are designed to be anonymous but there are many other factors that can dictate whether the owner […]

You can read the original blogpost by Fiete Stegers, on which this article was based, here. Where exactly was a photo on Twitter taken? When was a Facebook video recorded? Is that image fake, or authentic? These are just some of the common questions you can face when verifying social media content. A few months ago, Julia […]

Much of Bellingcat’s work requires intense research into particular events, which includes finding every possible photograph, video, and witness account that will help inform our analysis. Perhaps most notably, we exhaustively researched the events surrounding the shoot down of Malaysian Airlines Flight 17 (MH17) over eastern Ukraine. The photographs and videos taking near the crash […]

Throughout this story, click on any of the images to view in full resolution. When conducting open source investigations, an ever-present issue is how to archive away the materials you are researching. For example, a social media post may be deleted by a user after you publish an investigation, or a video on YouTube showing […]

Recently, the fitness app Strava published a “heatmap” of trillion of data points visualizing the information of users who submitted or synchronized their fitness activity to their servers. This data includes both fitness information recorded directly on the fitness app and data synchronized with the app from a number of physical fitness trackers, such as […]

Polar, a fitness app, is revealing the homes and lives of people exercising in secretive locations, such as intelligence agencies, military bases and airfields, nuclear weapons storage sites, and embassies around the world, a joint investigation of Bellingcat and Dutch journalism platform De Correspondent reveals.  In January Nathan Ruser discovered that the fitness app Strava revealed sensitive […]

This guide will show you how to digitally verify combatant affiliation in videos and photos from Middle East conflicts, a key tool for journalists.

Most digital research can be done without any issues on a desktop or laptop computer; however, sometimes you may need to use a mobile device to use particular applications. This guide will provide a walk-through on setting up a virtual Android device on a PC to conduct open source research. Android emulation is also possible […]

Evidence of human rights abuses often remains in some of the world’s most regional and unreachable parts. It is in these areas, where a view from satellite imagery above can be the sole method of visual evidence of bombings, attacks, and the destruction of communities. As satellite imagery becomes more available and technology permits for […]

In 2013, Russian political activist Alexey Navalny published a blog post in which he exposed a corruption scheme used on state procurement websites. Generally, in public procurement processes, the state customer publishes an advertisement for the purchase of goods or services, and the contractor offering the lowest price wins the tender and delivers the goods/services. […]

With few exceptions, everything that appears in your browser can be downloaded and transformed into useable data formats, with many organisations or individuals maintain complex and publicly accessible datasets containing valuable information. Despite being publicly viewable, in many cases the underlying data is not able to be downloaded and further analysed. This guide will focus […]

On 11 October 2014, a Facebook profile to a person named “Ruslan Boshirov” — the cover identity of Skripal poisoner Anatoliy Chepiga — posted a lone photograph of Prague, showing the heavily trafficked Old Town Square and the Astronomical Clock. The upload date of this photograph coincides with a report from the Czech publication Radiožurnal that […]

Since 2017 the European Union Agency of Law Enforcement Cooperation, better known as Europol, has been crowdsourcing parts of or heavily censored photographs, related to child abuse crimes in their “Stop Child Abuse – Trace an Object” campaign. Within two weeks after the start of their campaign Europol received 10.000 contributions from the public. Bellingcat, […]

URL previews are a nice feature found in most messaging applications. They allow you to paste a URL to a friend or colleague, and have a handy miniature view of the website you are about to view. The downside is that a lot of applications generate these previews without you knowing what is happening behind […]

Identifying changes in infrastructure is an important task for those of us surveilling areas for investigative purposes. Satellite imagery can show evidence of everything from the destruction of buildings, the erection of temporary structures, as well as newly constructed permanent facilities. This kind of information is important for analysis of events in conflict areas, as […]

A Case Study, Featuring the Electoral Roll of the Kyrgyz Republic When conducting digital investigations, using the tools already made available by the government can be a real help. Let’s use Kyrgyzstan as an example here. You may be looking for a witness or even a suspect in a crime, but you only know the […]

In recent years, cryptocurrencies such as Bitcoin  have been used by terrorists to conduct funding campaigns, authoritarian governments to subvert its citizens’ human rights, and GRU agents to hack the Democratic National Committee as well as the Clinton campaign. Though many people utilize virtual currencies for legitimate purposes, the technology is an enticing tool for […]

Update: SearchFace is dead, long live FindClone! This guide is now mostly for historical interest, as SearchFace has been taken offline and replaced with FindClone, a far easier tool to use than SearchFace was. You need to use a mobile telephone number to create an account for FindClone, which then gives you 20 or so searches […]

Whether you’re investigating a company purporting to have damning information on Robert Mueller or conducting research on anti-Islamic State foreign fighters in Iraq and Syria, LinkedIn can serve as a useful resource for online researchers across a wide variety of subjects. This guide aims to provide helpful tools and techniques for identifying LinkedIn profiles and […]