Skip to main content
Synced from an Obsidian vault

For graph and advanced features, download the full Intel Codex Vault and open it in Obsidian.

Investigation Index

Quick Navigation: Comprehensive guide to investigation procedures, platform-specific techniques, and entity profiling.

🎯 Investigation Workflow​

Standard Investigation Process​

Step-by-step:

  1. Pre-Investigation: Legal & Ethics Review → OPSEC Planning
  2. Collection Phase: Collection Logging + Platform SOPs + Entity Dossier
  3. Specialized Techniques: Image/Video Analysis / Web Infrastructure / Financial Investigation
  4. Escalation (if needed): Sensitive Crime Escalation
  5. Closure: Reporting & Disclosure

📱 Platform-Specific SOPs​

Social Media Platforms​

PlatformPrimary Use CasesDifficultyLink
Twitter/XReal-time info, public discourse, journalistsMedium[Twitter/X SOP](../Platforms/sop-platform-twitter-x)
InstagramVisual content, influencers, location trackingEasy[Instagram SOP](../Platforms/sop-platform-instagram)
TikTokYouth demographics, viral trends, OSINT challengesMedium[TikTok SOP](../Platforms/sop-platform-tiktok)
LinkedInProfessional networks, employment history, B2BEasy[LinkedIn SOP](../Platforms/sop-platform-linkedin)
RedditAnonymous communities, niche topics, AMAsMedium[Reddit SOP](../Platforms/sop-platform-reddit)
TelegramEncrypted messaging, groups, channelsHard[Telegram SOP](../Platforms/sop-platform-telegram)
BlueskyDecentralized Twitter alternative, tech early adoptersEasy[Bluesky SOP](../Platforms/sop-platform-bluesky)

Quick Platform Comparison​

A Best for:

  • Identity verification: LinkedIn, Facebook
  • Real-time events: Twitter/X, Telegram
  • Location intelligence: Instagram, TikTok
  • Anonymous investigations: Reddit, archived Twitter
  • Professional background: LinkedIn
  • Visual evidence: Instagram, TikTok
  • Encrypted comms analysis: Telegram

🔍 Investigation Techniques​

Core Techniques​

TechniqueDescriptionDifficultyLink
Entity DossierComprehensive person/org profilingMedium[Entity Dossier Template](../Techniques/sop-entity-dossier)
Image/Video OSINTReverse search, geolocation, metadataMedium[Image/Video Analysis](../Techniques/sop-image-video-osint)
Web/DNS/WHOISInfrastructure attribution, domain pivotingEasy[Web Infrastructure](../Techniques/sop-web-dns-whois-osint)
Financial/AMLBlockchain, company records, sanctions screeningHard[Financial Investigation](../Techniques/sop-financial-aml-osint)
Collection LoggingEvidence tracking, chain of custodyEasy[Collection Log](../Techniques/sop-collection-log)

Specialized Techniques​

Geolocation:

  • Image metadata (EXIF GPS coordinates)
  • Shadow analysis & sun position (SunCalc)
  • Landmark identification (Google Maps, OpenStreetMap)
  • Reference: Image OSINT - Geolocation

Blockchain Analysis:

  • Wallet clustering (Chainalysis, Elliptic)
  • Transaction tracing (Blockchain.info, Etherscan)
  • Mixer detection (Tornado Cash, Wasabi)
  • Reference: Financial OSINT - Crypto

Infrastructure Pivoting:

  • WHOIS reverse lookup (registrant email)
  • DNS history (SecurityTrails, DomainTools)
  • IP reverse lookup (Shodan, Censys)
  • SSL certificate transparency (crt.sh)
  • Reference: Web OSINT - Pivoting

👥 Entity Management​

Entity Types​

Entity Creation​

To create a new entity:

  1. Use Entity Dossier SOP as reference
  2. Start from blank Subject Profiles template
  3. Name format: entity-[type]-[identifier].md (e.g., entity-person-john-doe.md)
  4. Update entity type in frontmatter: person | org | domain | wallet | asset
  5. Set risk level: low | medium | high | critical
  6. Set confidence: low | medium | high

🛡️ Legal & Operational​

Pre-Investigation Requirements​

Legal Checklist:

  • Review Legal & Ethics SOP
  • Verify investigation scope and authorization
  • Confirm jurisdiction and applicable laws
  • Document legal basis for collection
  • Identify sensitive crime triggers (see escalation SOP)

OPSEC Checklist:

  • Review OPSEC Planning SOP
  • VPN/Tor configuration verified
  • Burner accounts created (if needed)
  • Browser fingerprinting protection enabled
  • No personal accounts used for investigation
  • Attribution risk assessed

Escalation Procedures​

When to escalate: Sensitive Crime Escalation SOP

Immediate escalation triggers:

  • Child safety concerns (CSAM, exploitation)
  • Imminent threat to life
  • Terrorism or national security
  • Human trafficking indicators
  • Active violent crime

Escalation contacts:

  • NCMEC (child safety): 1-800-843-5678 or CyberTipline.org
  • FBI (terrorism/national security): tips.fbi.gov
  • Local law enforcement (imminent threats): 911
  • Internal supervisor: [Contact info]

📊 Evidence & Reporting​

Evidence Collection​

Key practices:

  • Use Collection Log SOP for all evidence
  • Calculate hashes immediately (SHA-256 preferred)
  • Screenshot with timestamp & URL visible
  • Archive websites (Archive.org, archive.is)
  • Record chain of custody

Evidence structure:

/Evidence/
├── CASE-ID/
│   ├── screenshots/
│   ├── documents/
│   ├── videos/
│   ├── archives/
│   └── SHA256SUMS (hash verification file)

Reporting​

Final report: Reporting & Disclosure SOP

Report sections:

  1. Executive summary
  2. Scope and methodology
  3. Findings (organized by entity)
  4. Evidence appendix (with hashes)
  5. Recommendations
  6. Legal disclaimers

🧰 Essential Tools​

Quick Tool Reference​

Search & Discovery:

  • Google Advanced Search, DuckDuckGo
  • Shodan, Censys (internet-wide scanning)
  • Wayback Machine (website archives)
  • crt.sh (SSL certificate transparency)

Social Media:

  • Nuclei (username enumeration)
  • Social-Analyzer (social media OSINT)
  • Twint (Twitter scraping - archived tweets)
  • Nitter (Twitter privacy frontend)

Image/Video:

  • Google Image Search, TinEye, Yandex
  • InVID (video verification)
  • ExifTool (metadata extraction)
  • GeoGuessr, SunCalc (geolocation)

Infrastructure:

  • WHOIS, dig, nslookup
  • SecurityTrails, DomainTools
  • BuiltWith (technology profiling)
  • PublicWWW (source code search)

Blockchain:

  • Blockchain.info, Etherscan
  • Chainalysis Reactor (commercial)
  • Wallet Explorer (Bitcoin clustering)

Comprehensive tool lists:

  • Platform SOPs: Tool sections in each SOP
  • Technique SOPs: Specialized tool references
  • Main index: START → Security section

📚 Related Resources​

Internal References​

External Resources​

🔄 Investigation Templates​

Quick Start Templates​

New Person Investigation:

  1. Create entity file from template
  2. Run username enumeration: nuclei -tags osint -var user=username
  3. Check data breaches: Have I Been Pwned
  4. Social media audit: Twitter, LinkedIn, etc.
  5. Image search: Google, TinEye, PimEyes
  6. Log findings: Collection Log

New Organization Investigation:

  1. Create entity file from template
  2. Corporate records: [Company Registry Search](../Investigations/Techniques/sop-financial-aml-osint#Company Registries)
  3. Domain analysis: Web/DNS/WHOIS OSINT
  4. Blockchain (if applicable): [Crypto Tracing](../Investigations/Techniques/sop-financial-aml-osint#Cryptocurrency Tracing)
  5. Employee mapping: LinkedIn OSINT
  6. Sanctions screening: [AML Checks](../Investigations/Techniques/sop-financial-aml-osint#Sanctions Screening)

New Domain Investigation:

  1. WHOIS lookup: whois domain.com
  2. DNS enumeration: dig domain.com ANY, subfinder
  3. Certificate transparency: curl -s "https://crt.sh/?q=%25.domain.com&output=json"
  4. Reverse IP: Shodan, Censys, SecurityTrails
  5. Technology profiling: BuiltWith, Wappalyzer
  6. Archive search: Wayback Machine

📋 Case Management​

Active Cases​

TABLE case_id, entity_type, risk, confidence, updated
FROM "Cases"
WHERE type = "dossier"
SORT updated DESC
LIMIT 10

High-Risk Entities​

TABLE name, entity_type, risk, case_id, analyst
FROM "Cases"
WHERE type = "dossier" AND risk = "high" OR risk = "critical"
SORT updated DESC

Pending Review​

TABLE name, entity_type, confidence, updated
FROM "Cases"
WHERE type = "dossier" AND confidence = "low"
SORT updated DESC

🔔 Updates & Maintenance​

Last Updated: 2025-10-05 Index Version: 2.0 (post-reorganization) Next Review: 2025-11-05

Recent Changes:

  • 2025-10-05: Complete rewrite after vault reorganization
  • 2025-10-05: Added example entities (person, organization)
  • 2025-10-05: Enhanced entity dossier template with comprehensive workflows
  • 2025-10-05: Updated all SOP links to match new structure

Upcoming:

  • Add domain entity example
  • Add cryptocurrency wallet entity example
  • Create case management template
  • Add investigation workflow diagrams

Quick Links: 🏠 Home | ⚖️ Legal | 🔒 OPSEC | 👤 Entity Template | 📄 Reporting