Learn to Investigate¶
OSINT — Open Source Intelligence¶
OSINT means finding and analysing information that's publicly available.
No hacking required.
It's used in threat intelligence, investigations, journalism, fraud detection and security research.
Before you start
Looking at publicly available information doesn't automatically mean you're entitled to use it however you want. Don't use OSINT to stalk, harass, impersonate or target people.
| Technique / Tool | What it does |
|---|---|
| Google Lens / Reverse Image Search | Find where an image appears elsewhere online |
| TinEye | Reverse image searching |
| Sherlock | Search for a username across many platforms |
| ExifTool | Examine metadata stored in files and images |
| GeoGuessr | Useful practice for visual geolocation |
| Google search operators | Narrow searches using site:, "exact phrase", filetype: and similar operators |
Try this on yourself¶
Search your own name and usernames like a stranger would.
What can you find?
- Old accounts
- Old usernames
- Public photos
- Forgotten profiles
- Information you've posted publicly
- Things you didn't realise were visible
That's one of the best introductions to OSINT because you're investigating a target you are actually authorised to investigate:
yourself.
Digital forensics basics¶
Where OSINT looks at what's public, digital forensics looks at what's already on a device — recovering, preserving and analysing evidence after something's happened. It's named as its own career direction in Career Paths, but hadn't actually been covered here until now.
| Tool | What it does |
|---|---|
| Autopsy | Free, open-source platform for analysing a disk image — files, timelines, deleted data |
| FTK Imager | Free tool for creating a forensically sound copy of a drive before anyone analyses it — needs free registration to download |
The golden rule applies here too: image and analyse your own drives, or a purpose-built forensic image someone's published for practice — never someone else's device without permission.
CyberDefenders has free, real-world DFIR challenges — actual disk images, memory dumps and packet captures to practise against once the tools are installed.
This section is thin, and that's known
This is a starting point, not a real pathway — actively looking for someone with genuine DFIR experience to build it out properly. If that's you, get in touch — until then, treat this as "better than nothing," not "figured out."