Quick links: Article cards – Full list – Raw spreadsheet In January of 2017, CIA made the entirety of their declassified records collection available online. Previously, only select documents were available through the online collection, with the rest available only through National Archives at College Park, Maryland. Thus, for researchers of intelligence such as myself, […]

This post was originally posted on the AutomatingOSINT.com blog here.A few years ago Lawrence Alexander published a great piece on finding connections between websites using Google Analytics (among others) codes. Last year I had published a post where I taught you how to automatically mine some of this information using Python, and then how to visualize it. Unfortunately the […]

This article was originally posted to the AutomatingOSINT.com blog. More and more investigations are being conducted on Tor and many of them can also include investigating Bitcoin transactions. The nature of Bitcoin is such that the transactions themselves are designed to be anonymous but there are many other factors that can dictate whether the owner […]

You can read the original blogpost by Fiete Stegers, on which this article was based, here. Where exactly was a photo on Twitter taken? When was a Facebook video recorded? Is that image fake, or authentic? These are just some of the common questions you can face when verifying social media content. A few months ago, Julia […]

Much of Bellingcat’s work requires intense research into particular events, which includes finding every possible photograph, video, and witness account that will help inform our analysis. Perhaps most notably, we exhaustively researched the events surrounding the shoot down of Malaysian Airlines Flight 17 (MH17) over eastern Ukraine. The photographs and videos taking near the crash […]

Throughout this story, click on any of the images to view in full resolution. When conducting open source investigations, an ever-present issue is how to archive away the materials you are researching. For example, a social media post may be deleted by a user after you publish an investigation, or a video on YouTube showing […]

Recently, the fitness app Strava published a “heatmap” of trillion of data points visualizing the information of users who submitted or synchronized their fitness activity to their servers. This data includes both fitness information recorded directly on the fitness app and data synchronized with the app from a number of physical fitness trackers, such as […]

Polar, a fitness app, is revealing the homes and lives of people exercising in secretive locations, such as intelligence agencies, military bases and airfields, nuclear weapons storage sites, and embassies around the world, a joint investigation of Bellingcat and Dutch journalism platform De Correspondent reveals.  In January Nathan Ruser discovered that the fitness app Strava revealed sensitive […]

This guide will show you how to digitally verify combatant affiliation in videos and photos from Middle East conflicts, a key tool for journalists.

Most digital research can be done without any issues on a desktop or laptop computer; however, sometimes you may need to use a mobile device to use particular applications. This guide will provide a walk-through on setting up a virtual Android device on a PC to conduct open source research. Android emulation is also possible […]

Evidence of human rights abuses often remains in some of the world’s most regional and unreachable parts. It is in these areas, where a view from satellite imagery above can be the sole method of visual evidence of bombings, attacks, and the destruction of communities. As satellite imagery becomes more available and technology permits for […]

In 2013, Russian political activist Alexey Navalny published a blog post in which he exposed a corruption scheme used on state procurement websites. Generally, in public procurement processes, the state customer publishes an advertisement for the purchase of goods or services, and the contractor offering the lowest price wins the tender and delivers the goods/services. […]

With few exceptions, everything that appears in your browser can be downloaded and transformed into useable data formats, with many organisations or individuals maintain complex and publicly accessible datasets containing valuable information. Despite being publicly viewable, in many cases the underlying data is not able to be downloaded and further analysed. This guide will focus […]

On 11 October 2014, a Facebook profile to a person named “Ruslan Boshirov” — the cover identity of Skripal poisoner Anatoliy Chepiga — posted a lone photograph of Prague, showing the heavily trafficked Old Town Square and the Astronomical Clock. The upload date of this photograph coincides with a report from the Czech publication Radiožurnal that […]

Since 2017 the European Union Agency of Law Enforcement Cooperation, better known as Europol, has been crowdsourcing parts of or heavily censored photographs, related to child abuse crimes in their “Stop Child Abuse – Trace an Object” campaign. Within two weeks after the start of their campaign Europol received 10.000 contributions from the public. Bellingcat, […]

URL previews are a nice feature found in most messaging applications. They allow you to paste a URL to a friend or colleague, and have a handy miniature view of the website you are about to view. The downside is that a lot of applications generate these previews without you knowing what is happening behind […]

Identifying changes in infrastructure is an important task for those of us surveilling areas for investigative purposes. Satellite imagery can show evidence of everything from the destruction of buildings, the erection of temporary structures, as well as newly constructed permanent facilities. This kind of information is important for analysis of events in conflict areas, as […]

A Case Study, Featuring the Electoral Roll of the Kyrgyz Republic When conducting digital investigations, using the tools already made available by the government can be a real help. Let’s use Kyrgyzstan as an example here. You may be looking for a witness or even a suspect in a crime, but you only know the […]

In recent years, cryptocurrencies such as Bitcoin  have been used by terrorists to conduct funding campaigns, authoritarian governments to subvert its citizens’ human rights, and GRU agents to hack the Democratic National Committee as well as the Clinton campaign. Though many people utilize virtual currencies for legitimate purposes, the technology is an enticing tool for […]

Update: SearchFace is dead, long live FindClone! This guide is now mostly for historical interest, as SearchFace has been taken offline and replaced with FindClone, a far easier tool to use than SearchFace was. You need to use a mobile telephone number to create an account for FindClone, which then gives you 20 or so searches […]

Whether you’re investigating a company purporting to have damning information on Robert Mueller or conducting research on anti-Islamic State foreign fighters in Iraq and Syria, LinkedIn can serve as a useful resource for online researchers across a wide variety of subjects. This guide aims to provide helpful tools and techniques for identifying LinkedIn profiles and […]

After posting a tutorial on tracking GRU agents’ bitcoin (BTC) transactions, I’ve received numerous responses asking how to find out even more. I aim to please, so I’ve put together another tutorial using Izz ad-Din al-Qassam Brigades’ bitcoin funding campaign as a case study. What You’ll Need To effectively analyze any bitcoin address, I rely […]

Popular apps such as TrueCaller or GetContact advertise the ability to see who is really calling you, even if you do not know the number, and alert the app user of spam or scam calls. However, the way that these apps gather information to determine the name of an unknown caller is not as broadly […]

To some researchers, TweetDeck might seem superfluous in a world where Twitter Advanced Search exists. The platform would appear to be just a prettier version of what you are already doing through Twitter. However, I am here to show you how TweetDeck can vastly simplify and organize your research while allowing you to collect a […]