How to Conduct an OSINT Investigation: A Practical Research Guide
An OSINT investigation is a structured enquiry into a defined question using lawfully accessible information. Its value comes from verification and analysis: a folder of search results becomes useful only when another person can understand what the records establish, what they do not establish and why the distinction matters.
- Define a decision and a testable question before collecting information.
- Resolve identities before connecting records, profiles or companies.
- Preserve source context and separate observations from interpretation.
- Test the strongest alternative explanation, then state the remaining uncertainty.
1. Turn the concern into a research question
“Find everything about this supplier” is a starting concern, not a research plan. A better question is: “Does the named supplier have undisclosed relationships with the intermediary recommending it?” This defines the subjects, the connection to test and the business decision the research supports.
Write a one-paragraph brief naming the requester, legitimate purpose, subjects, relevant period, countries, deadline and intended recipient. Set a boundary around unrelated personal information. If a fact would not change the decision or help verify another material fact, consider whether it belongs in the enquiry at all.
Agree a stopping rule. For example, the first stage might establish identity, map directly connected entities and test three specific disclosures. New people or countries become proposed extensions, not an automatic reason to keep collecting.
| Weak brief | Researchable question | Expected output |
|---|---|---|
| Check a person | Do the disclosed roles match dated company records? | A verified role chronology and unresolved discrepancies |
| Find suspicious links | Is there evidence of shared ownership between these entities? | A relationship map with a source for each material link |
| Investigate a website | Which public identifiers connect the site to a known business? | An attribution assessment with competing explanations |
2. Build a source plan around the question
List the information needed to answer the question before choosing tools. For an ownership enquiry, that may mean company identifiers, historical filings, directors and overseas parents. For a disputed event, it may mean original posts, dates, photographs and independent records of what happened.
Assign a source category to each information need. Start with the original source where practical, then look for independent corroboration. A news story quoting a company statement and three websites copying that story are not four independent confirmations.
Maintain a coverage log. Record sources checked, search terms, relevant dates and meaningful access limitations. An empty result from one search engine is different from a complete search of a defined register. This distinction helps prevent a later “nothing found” conclusion from implying more coverage than was actually achieved.
- Use original names, known aliases and relevant languages.
- Separate record discovery from review of the underlying document.
- Prioritise sources likely to change the answer; leave low-value browsing for later.
3. Resolve identity before building connections
Names are weak identifiers on their own. Combine several attributes: entity number, dated employment, location, professional history or a verified contact point. Record why each item belongs to the subject and what evidence excludes a plausible namesake.
Create an identity table before drawing a network. Distinguish confirmed identifiers from candidate ones. A username reused on two platforms may be a lead, but it does not automatically identify the same operator. A company address can also belong to many unrelated registered businesses.
When identifiers conflict, pause the chain of inference. A later conclusion inherits uncertainty from its earliest identity assumption. It is better to mark two candidate profiles as unresolved than to produce an elaborate relationship diagram built around a mistaken match.
4. Collect information with its context
Keep a source reference for every material item: URL or record reference, page title, publisher or account, access date and the date the material claims to describe. Where relevant and appropriate, preserve the underlying file or page capture as well as a readable extract.
Record what was actually observed. “The page displayed this statement on the access date” is different from “the statement is true.” A screenshot can preserve an observation without proving authorship, the date of an event or the accuracy of the claim.
Use a stable evidence identifier so a report sentence, working note and saved item point to the same material. Keep an original copy and a separate working copy when annotation or translation is required. Document transformations, including cropping or OCR, rather than silently replacing the source with a processed version.
5. Test claims and competing explanations
Break a broad allegation into smaller propositions. Instead of asking whether a business is “a front,” ask whether it exists under the claimed identity, whether its officers match disclosures, whether it shows evidence of activity and what supports a particular control relationship.
For each proposition, record supporting evidence, contradictory evidence and plausible alternatives. Two firms sharing a director may be part of a group, use a professional service provider or have only a historical association. The task is to determine which explanation the available evidence supports.
Use confidence language tied to specific reasons. “Supported by two independent records” is more informative than an unexplained numerical score. If an important source is stale, inaccessible or dependent on another source, explain how that limits the conclusion.
| Observation | Possible inference | What still needs checking |
|---|---|---|
| Two sites use the same contact number | A common operator or service provider may be involved | Whether the number is current, exclusive and independently attributable |
| A director appears in an older filing | A historical role is documented | Whether that role continued during the relevant period |
| Several articles repeat an allegation | The allegation circulated publicly | Whether there is independent evidence for the underlying event |
6. Build a chronology and an evidence map
A chronology helps expose contradictions that a collection of profiles can conceal. Record the claimed event date separately from publication and access dates. Use a consistent time zone when the sequence depends on hours rather than months or years.
A relationship map should explain each edge. Label it as a recorded directorship, shareholding, shared contact, reported association or analytical inference. Include dates where roles or ownership changed. Visual proximity should never do the work of evidence.
Review whether the facts answer the original question. If the investigation has produced interesting background but no material answer, narrow the remaining gap. A focused follow-up question may be more useful than another round of broad searches.
Worked example: testing an undisclosed supplier connection
Illustrative scenario: a purchasing team notices that a proposed supplier and an intermediary use similar descriptions of a previous project. The initial hypothesis is shared control. The alternative is that both participated in the same project without an ownership relationship.
First resolve the entities and dates. Next compare officer histories, corporate filings and original project references. Preserve the shared wording, but do not treat it as proof. If a dated filing establishes an overlapping officer during the relevant period, report that precise relationship and test whether the disclosure omitted it.
A proportionate conclusion might be: “A historical shared officer is documented; current common ownership was not established from the sources reviewed.” The procurement team can then ask a targeted question. The report should not upgrade the limited finding into a claim that the supplier is fraudulent.
7. Deliver a report another person can check
Lead with the answer to the question, followed by the evidence supporting it and the limitations that could change it. Put extensive background in an appendix. Distinguish confirmed facts, reported claims, analysis and open questions using consistent labels.
Include scope, identity resolution, source coverage, a findings table, relevant chronology, evidence index and proposed next steps. A next step should explain what it would resolve, not simply recommend “further investigation.” Document what was deliberately excluded.
Before delivery, ask a reviewer to trace the most important conclusion back to the underlying items and argue the strongest alternative explanation. If the conclusion cannot survive that review, revise it. When the enquiry needs specialist languages or a defensible handover, professional OSINT investigation services can be scoped around the unresolved question.
Frequently asked questions
How do I start an OSINT investigation when I only have a name?
Start by defining the legitimate question and gathering non-sensitive context already available to you: claimed role, relevant company, time period and country. Treat initial matches as candidates. Identity resolution should come before collecting adverse records or connecting social accounts.
How do I know when I have collected enough information?
Use the stopping rule agreed in the brief. Ask whether the material question is answered, the strongest alternative was tested and remaining gaps are visible. More information is not automatically better if it does not change the assessment or improve verification.
Can an AI-generated summary be treated as a source?
Use it as a research aid, then verify each material statement against the underlying record. Preserve the real source and check whether the summary omitted context, confused identities or merged dates. A fluent explanation does not establish accuracy.
What does “nothing found” mean in an OSINT report?
It should refer to a defined set of sources, identifiers and dates. It does not establish that an event never occurred. State where research was incomplete or records were unavailable so the reader can assess the significance of the negative result.
Sources and further reading
This guide presents an editorial research workflow. The specialist references below support its background concepts; the examples are hypothetical and do not describe client cases. Source scope and access can change, so record what was available during your own enquiry.