OSINT Investigation Techniques: A Step-by-Step Guide

In short: An OSINT (open-source intelligence) investigation (OSINT methodology; digital open-source investigation) uses information anyone can lawfully access, such as websites, social media, archives and public records, to answer a specific question. Core techniques include: plan the question, search precisely, preserve what you find, verify it, trace who is behind it, and map how it spreads. Debunk.org uses these steps to investigate disinformation and scam networks.

Want structured training? Start FIMI 101 → debunkacademy.org Get new investigations by email → debunk.org/subscribe

Key facts

• Open source information is "publicly available information that any member of the public can observe, purchase or request without requiring special legal status or unauthorised access", according to the Berkeley Protocol (UN OHCHR and UC Berkeley).

• The Berkeley Protocol divides a digital open-source investigation into six phases: online inquiries, preliminary assessment, collection, preservation, verification, and investigative analysis.

• Preserving evidence (screenshots and archived copies with the date and address) comes before analysis, because influence and scam content is often deleted within hours.

• Analysts separate strong links between accounts or websites, such as a shared tracking code, from weak ones, such as a shared hosting company.

• Debunk.org analysis of a Facebook ad network, September 2023 – September 2024: open-source techniques linked nearly 3,000 dubious ads to 70 domains and 246 Facebook pages.

• Debunk.org test of three free checks on its own domain, 24 October 2026: RDAP gives the registration date (12 April 2006) and registrar; the Wayback Machine has captures back to November 2003; and crt.sh lists 15 current certificates, all for debunk.org and its own subdomains.

• Debunk.org analysis of Operation Overload emails received, September 2023 – July 2026: 1,166 emails, 97.9% of them sent Monday to Friday, a working-week pattern visible only after systematic collection.
  

What is an OSINT investigation?

An OSINT investigation answers a specific question using only information that anyone can lawfully access.

The Berkeley Protocol, the UN-backed standard for digital open source investigations, defines open source information as "publicly available information that any member of the public can observe, purchase or request without requiring special legal status or unauthorised access". Open source intelligence is the part collected and analysed to answer a particular question.

The protocol sets out an investigation cycle of six phases: online inquiries, preliminary assessment, collection, preservation, verification and investigative analysis. The steps below follow the same logic, applied to disinformation.

Free tools for each step

You can do every step below with free tools; we tested 19and list them by category on a separate page.

See Free OSINT tools: 19 we tested for archives, reverse image search, domain and website checks, ad libraries and sanctions databases, each with what it does and the date we tested it.

How to do an OSINT investigation: 7 steps

An OSINT investigation moves through seven steps, from a clear question to a sourced report; each step below says what to do and which free tools help.

Step 1: Define the question

A good OSINT investigation starts with one clear question, such as "Who runs this website?" or "Are these accounts coordinated?"

Write the question down, with what would answer it and what would not. "Is this campaign Russian?" is too broad to answer from open sources; "Do these 40 accounts share creation dates, images and posting times?" can be checked. A clear question also tells you when to stop.

Step 2: Search precisely

Precise search operators find what general searches miss.

Google's own help pages list operators such as:

• "exact phrase" in quotation marks, for a slogan or a sentence copied between sites;

• site: to search one website or platform (site:example.com "keyword");

• minus (-) to exclude a word;

• filetype: to find documents such as PDFs;

• before: / after: to limit results by date.

Search in the target audience's languages, not only in English: an operation aimed at Lithuania will use Lithuanian keywords. Platform search, ad libraries, and reverse image search (step 4) add what web search can't see.

Step 3: Preserve the evidence

Save every piece of evidence with its address and date before you analyse it, because influence and scam content disappears fast.

• Take a full-page screenshot that shows the address and the date.

• Save the page in the Wayback Machine ("Save Page Now") or another archive.

• Record the link, the date and time you saw it, and how you found it in a simple log.

In Debunk.org's analysis of a Facebook scam-ad network, most ads stayed online for only a day or a few days; by the time of publication, none of the 70 domains was still reachable. Without preserved copies, there would have been nothing left to analyse.

Step 4: Verify

Verification checks whether content is what it claims to be: who made it, when, where and whether it was altered.

• Reverse image search (Google Lens, Bing Visual Search, Yandex Images) shows where an image appeared before. Reusing an old photo for a new event is one of the most common fakes.

• Check the source: is it the outlet it claims to be? Cloned news sites copy a real outlet's design on a lookalike address.

• Check the date and place: shadows, weather, signs and landmarks should match the claimed time and location.

• Check for AI generation: see our guide on how to tell if an image is AI-generated.

Step 5: Trace who is behind it

Tracing ownership means following a website's or account's technical and behavioural traces back to whoever controls it.

For websites: registration data (WHOIS/RDAP), archived versions, tracking codes, security certificates and hosting. Our step-by-step guide on how to find out who owns a website covers each one.

For social media accounts and pages: creation date, name changes, the countries of page administrators (shown in Meta's page transparency section and the Meta Ad Library), profile photos (reverse-searched), and which other accounts they interact with.

Step 6: Map the network

Network mapping shows whether accounts and websites act together, which separates a coordinated operation from people who happen to agree.

Look for:

• many accounts created within a short period;

• the same text, images or links posted within minutes;

• activity that follows one working day or one time zone;

• websites that share a tracking code, a security certificate or a registration batch;

• the same content moved from platform to platform to look independent.

Weigh each link: a shared tracking code is strong, a shared hosting company is weak. You need one strong link, or several independent medium ones, before you call accounts or sites connected. Our guide to bot farms and troll farms lists the signs of coordinated fake accounts.

Step 7: Analyse and report

The final step turns evidence into findings: what happened, who is likely behind it, how far it spread and how sure you are.

Analysts structure findings with shared frameworks:

• the ABCDE framework: actor, behaviour, content, degree, effect;

• the DISARM framework: a code for each technique;

• the Breakout Scale: how far an operation spread.

Say what you could not find out, and how confident you are. Quote false claims as claims, and never reshare fakes without a clear label.

Practise these techniques on real cases. FIMI 101 teaches OSINT checks, the ABCDE and DISARM frameworks and how to document an influence operation. → Start FIMI 101

Worked case: three free checks on one domain

Three free checks show a domain's history without any special access. To show them without naming anyone, we ran them on our own domain, debunk.org, on 24 October 2026.

1. Registration (RDAP): the registry gives a registration date of 12 April 2006, a transfer on 20 May 2021 and the registrar (GoDaddy). It does not show the owner's name, which is normal.

2. Archives (Wayback Machine): the first capture is from 2 November 2003, before the current registration date. A registration date shows only the current registration, not the whole history of an address.

3. Certificates (crt.sh): there are 15 current security certificates, all for debunk.org and its own subdomains. On a suspicious site, the same check can reveal other addresses that are run together.

What this shows: with free tools you can date a domain, see how far back it was in use and check which addresses share its certificates. What it doesn't show: who owns it. That needs the other traces in how to find out who owns a website.

Real cases from Debunk.org's investigations

Debunk.org applies these techniques to scam networks and foreign influence operations.

Example: how we traced the Belarusian Silovik Telegram channel and its spread on X.

Ethics and safety

Ethical OSINT means using only lawfully accessible information, protecting the people you research and protecting yourself.

• Don't hack, guess passwords or use leaked databases.

• Don't pose as someone else to get into closed groups.

• Don't publish private people's personal data; name organisations, or people only when an official body has named them.

• Protect yourself: keep your research accounts and devices separate from your personal ones, and be careful with links and attachments from the operations you study.

The Berkeley Protocol also covers investigators' "digital, physical and psychosocial" security.

FAQ

What are OSINT techniques? Methods for finding, preserving, verifying and analysing publicly available information: precise searching, archiving, reverse image search, domain and account checks, and network mapping.

How do I start an OSINT investigation? Write down one specific question, then search, preserve everything you find with its address and date, and verify before you analyse.

Is OSINT legal? Collecting publicly available information is generally legal, but how you obtain and use it matters: don't access systems without authorisation, don't deceive, and handle personal data with care. This is general information, not legal advice.

What is the difference between OSINT and fact-checking? Fact-checking asks whether a claim is true. An OSINT investigation can also ask who is spreading it, how, and with what infrastructure.

Do I need paid tools for OSINT? No. Most of the techniques above use free tools; paid services add scale and history.