OSINT Quick-Start Guide
Open-Source Intelligence (OSINT) is the disciplined practice of producing actionable analysis from publicly available information. It is not a search-engine hobby and it is not investigative journalism — it is a structured tradecraft, and like any tradecraft it has a method, a toolset, and a body of professional standards. This guide is your on-ramp.
Who This Guide Is For
This guide is written for analysts, journalists, researchers, and compliance professionals who are beginning OSINT work and want a structured entry point — the first 30 days of practice, not the first five years. It is not a replacement for the deeper methodology notes elsewhere in this vault; it is the orientation that comes before them. If you read this guide, do the exercises, and follow the linked deep-dives, you will be operating at an entry-professional level within a few weeks of consistent practice.
The OSINT Mindset — Three Principles
OSINT is a discipline before it is a toolkit. The tools change every year; the mindset does not. Three principles separate competent practitioners from everyone else.
Verify before you conclude. OSINT surfaces information, not truth. Every claim from every source — including government press releases, mainstream media reports, leaked documents, and corporate filings — requires independent corroboration before it can support an analytical conclusion. A single source is a lead. Two independent sources from non-overlapping origins are evidence. One source citing another is still one source.
Document everything. If a finding is not documented at the moment of collection, it does not exist for analytical or legal purposes. Web pages disappear, social media accounts are deleted, and screenshots without timestamps and hashes carry no evidentiary weight. The discipline is simple: screenshot, hash, and archive at the moment of discovery — not later. Build this habit before you build anything else.
Know your legal boundary. Collection from genuinely public sources is generally lawful in most jurisdictions. Scraping behind authentication, bypassing technical access controls, harvesting personal data at scale, and re-publishing identifiable information about private individuals can cross into civil and criminal violations — and the specifics vary by country. When uncertain, stop collecting, document what you have, and consult a legal framework before proceeding.
The Five-Step OSINT Cycle (Applied)
The intelligence cycle adapted to beginner OSINT practice. Run every investigation through these five steps in order. Skipping a step is the most common cause of unreliable findings.
Step 1 — Define the question precisely. What specifically do you need to know? What decision does the answer support? “Investigate this company” is not a question. “Does this company have undisclosed ownership ties to a sanctioned entity?” is a question. Write the question down before you open a browser. If the question shifts during the investigation, write the new question down too.
Step 2 — Identify the likely sources. Where would the answer live if it exists in open sources? Corporate registries for ownership questions, archived web pages for deleted content, social media for personal patterns of life, satellite imagery for physical infrastructure, court filings for legal disputes. Map the source landscape before you start collecting — five minutes of thinking saves hours of unfocused searching.
Step 3 — Collect. Use the tools in the next section. Document everything: URL, retrieval timestamp, screenshot, and a hash of the captured artifact. Maintain a collection log — a simple spreadsheet works. The discipline is non-negotiable.
Step 4 — Verify. Require a minimum of two independent sources for any factual claim that will appear in your output. Check every piece of media for the four Ds: Distortion (was the original altered?), Disinformation (was it created to mislead?), Decontextualization (is a real artifact being presented in a false context?), and Deepfake (was it synthetically generated?). When verification fails, the finding is downgraded from fact to lead.
Step 5 — Synthesize and communicate. State what you found, the confidence level (Low / Medium / High based on source quality and corroboration), and — critically — what gaps remain. Analysts who acknowledge their gaps are trusted; analysts who hide them are eventually discovered.
Essential Free Tool Stack — Beginners
The tools below are sufficient for the first six months of OSINT practice. Master these before adding anything else.
| Tool | Function | URL / Install | Limit |
|---|---|---|---|
| Google / Bing advanced operators | Targeted search via site:, filetype:, intitle:, inurl:, before:, after: | Built into both engines | Search engines deprecate operators; cross-test results between engines |
| Wayback Machine | Archived web pages and deleted content | archive.org/web | Coverage is incomplete; missing snapshots are common |
| Google Images reverse search + TinEye | Reverse image search | images.google.com, tineye.com | Both miss recently published or cropped images; use Yandex as third leg |
| ExifTool / Jeffrey’s Exif Viewer | Image metadata extraction | exiftool.org (CLI), exif.regex.info (web) | Most social platforms strip EXIF on upload |
| Sherlock | Username sweep across 300+ platforms | github.com/sherlock-project/sherlock | False positives common; verify each hit manually |
| Shodan.io (free tier) | Internet-connected device discovery | shodan.io | Free tier limits queries per day; full coverage requires paid plan |
| OpenCorporates | Corporate registry research | opencorporates.com | Coverage varies by jurisdiction; pair with national registries |
| Intelligence X (IntelX) free tier | Email/username in breach datasets | intelx.io | Free tier returns limited results; treat breach data with legal caution |
| Hunter.io free tier | Corporate email pattern discovery | hunter.io | Free tier capped at 25 searches/month |
| Hunchly (paid, ~$20/month) | Evidence capture with automatic hashing | hunch.ly | Paid — and the single most important professional tool for a beginner to adopt early |
If you adopt only one paid tool in your first year, make it Hunchly. The evidentiary discipline it enforces — automatic capture, automatic hashing, automatic chain-of-custody — is otherwise extraordinarily difficult to maintain manually.
Ten First Skills to Develop
Ordered by payoff-to-difficulty ratio. Work down the list. Do not skip ahead — each skill assumes the prior ones.
- Google advanced operators. The single highest-leverage skill in OSINT. An afternoon spent learning
site:,filetype:,intitle:,inurl:,before:,after:, and exact-phrase quoting will permanently change how you search. - Reverse image search pipeline. Run every image of interest through Google Images, TinEye, and Yandex in sequence. Each indexes different parts of the visual web. Yandex is consistently strongest on faces and Cyrillic-language sources.
- Wayback Machine and archive.today research. Learn to find archived snapshots, to compare versions of a page across time, and to submit captures yourself before sensitive content disappears.
- Username sweep with Sherlock. A starting point for entity research — but every Sherlock hit is a hypothesis, not a confirmation. Manual verification is required.
- Corporate registry research. Learn OpenCorporates plus at least one national registry relevant to your work (Companies House for the UK, SEC EDGAR for the US, JUCESP/Receita Federal for Brazil, and so on).
- Image EXIF extraction. Routine on any image not sourced from a major social platform. Camera model, timestamp, and GPS coordinates are often intact in images shared via cloud storage, email, or messaging apps that do not strip metadata.
- Geolocation from photographs. Sun angle, architectural detail, vegetation, signage, vehicle license plate formats, and electrical infrastructure all narrow a location. This is the highest-prestige and most in-demand individual OSINT skill in the field.
- Social media account research. LinkedIn deep search (for professional networks and employment history) and X/Twitter advanced search operators (
from:,to:,since:,until:,near:) are foundational. Each platform has its own search grammar. - Domain and WHOIS research. Current WHOIS via whois.domaintools.com, historical WHOIS via domaintools or whoxy, DNS records via dig or online resolvers. Domain history often reveals ownership transitions that current records hide.
- Evidence documentation and hashing discipline. SHA-256 every captured artifact at the moment of capture. Use Hunchly if your budget allows; if not, build a manual workflow with screenshots,
sha256sum, and a structured folder hierarchy. Without this discipline, your work cannot support legal or formal analytical processes.
Common Beginner Mistakes
- Stopping at the first result. The first Google result is what everyone sees. OSINT begins where obvious searching ends — pages two through ten, operator-narrowed queries, alternate engines, and archived versions.
- Forgetting to archive. Web content of investigative interest disappears within hours of becoming relevant. Submit captures to archive.today and the Wayback Machine before you analyze, not after.
- Assuming correlation is causation. Two entities sharing an attribute — the same city, the same school, the same supplier — does not mean they are operationally connected. Coincidence is more common than connection.
- Publishing before verifying. Open-source content includes deliberately planted disinformation designed to be discovered by analysts like you. A single-source finding is a lead; treating it as a fact is how reputations are lost.
- Using personal accounts and devices. Operational separation between your personal life and your OSINT work is a basic professional standard. Subjects of investigation can and do investigate back.
Where to Go From Here
The notes below take each topic deeper. Read them in roughly the order listed.
- OSINT — the full conceptual foundation of the discipline
- Intelligence Cycle — the broader intelligence methodology underlying the five steps
- Geolocation Methodology — the most in-demand single OSINT skill, in depth
- Entity Resolution Methodology — disambiguating who is who across sources
- Pattern of Life Analysis — behavioral analysis from open sources
- Source Verification Framework — evaluating source quality systematically
- OSINT Ethics — the ethical framework for responsible collection
- OSINT Legal Framework — legal boundaries by jurisdiction
- OSINT Community Ecosystem — training resources, CTFs, and the practitioner community
- 08 — OPSEC for the Independent Analyst — protecting yourself while you research
Start with the OSINT mindset. Build the documentation habit before anything else. Work down the ten-skill list. Everything else in the discipline grows from there.