The OSINTion Tidbit

From Searching to Investigating: An OSINT Framework

Joe Gray — Tue, 23 Jun 2026 12:03:35 GMT

If you found this publication through searching for something specific and ended up reading posts about intelligence requirements, source reliability, and the difference between collection and analysis, you may be wondering whether any of it applies to you yet. It does. But there is some foundation worth building first, and that is what this post covers.

Subscribe now

This is not a tool list. There are plenty of those, and most of them teach you to run before you know how to walk. This is about the mindset and the habits that determine whether someone who gets into OSINT develops into a practitioner or stays a person who is good at searching.

The Difference Between Searching and Investigating

Searching is a task. You put something into a box and see what comes back. Most people who think they are doing OSINT are searching. They are good at it. They know more tools than the average person and they can find things other people miss. That is genuinely useful. It is not the same as investigating.

Photo by Markus Winkler on Unsplash

Investigating starts before the search begins. It starts with a question. Not a subject, not a name, not a topic: a specific question that the investigation needs to answer. Before you open a browser, before you run a query, before you reach for a tool, you need to know what you are trying to find out and what a complete answer looks like. Without that, you are not investigating. You are browsing with better tools.

The practical way to enforce this habit early is to write the question down before you do anything else. A sentence or two, specific enough that you could hand it to someone else and they would know what they were supposed to find out. If you cannot write it clearly, you do not know what you are investigating yet. That is useful information. It means you need to think before you search, not after.

The second part of the mindset shift is what you do with what you find. Searching produces results. Investigating produces assessments. A result tells you something exists. An assessment tells you what it means, how confident you are in that interpretation, and what the gaps are. Most beginners stop at results and call the work done. The whole second half of the process never happens, because nobody told them it was supposed to.

The third part is documentation. Every piece of information you collect during an investigation needs to be recorded with enough context that you or someone else could reconstruct how you found it. The source, the date it was retrieved, the platform or database it came from, the search terms or method used to surface it. This feels like overhead until the first time you need to go back and verify something you found three weeks ago and cannot remember where it came from. Documentation is not bureaucracy. It is what makes your work usable and defensible.

The First Tools Worth Learning

The tools worth learning first are the ones that build transferable skills rather than platform-specific workflows. Search engines are the right starting point because understanding how to construct a precise query, how to use operators to narrow or expand results, and how to think about what a search engine indexes versus what it does not is foundational to almost everything else.

Google’s advanced search operators or “Google Dorks” are not exotic. Site-specific searches, exact phrase matching, date range filtering, and file type searches are available to anyone and underused by almost everyone. Understanding why they work the way they do, rather than just memorizing the syntax, is what lets you apply the underlying logic to other search interfaces.

Archive services come next. The Wayback Machine is essential because the open source environment changes constantly, and content that exists today may not exist tomorrow. Building the habit of archiving what you find as you find it, rather than bookmarking live URLs, is something experienced practitioners do automatically and beginners almost never do until they have lost something important.

Reverse image search is one of the highest-value skills relative to the effort required to develop it. Google Lens, PimEyes, and Yandex’s image search each index different content and return different results, and using all 3 rather than just the most familiar one meaningfully improves coverage. Understanding what reverse image search can and cannot tell you, including its significant limitations with AI-generated content, is part of the skill.

Document and record research varies significantly by country and jurisdiction but is worth learning in whatever context is most relevant to your work. Understanding what public records exist, where they are held, what they contain, and how to request or search them is a durable skill that does not become obsolete when a platform changes its API.

Social media investigation as a skill set is worth learning deliberately rather than picking up informally. Understanding how to search platform-native archives, how to use advanced search features that are not surfaced prominently, how to capture and archive what you find, and how to interpret what account activity and history do and do not tell you is a distinct body of knowledge from simply being a social media user.

The Most Common Beginner Mistakes

Starting with tools rather than questions is the root cause of most beginner errors. When you start with a tool, the tool shapes what you look for. You find what the tool is capable of returning rather than what the investigation requires. Start with the question. Let the question determine which tools are appropriate.

Accelerated Introduction to Intelligence

Treating search results as findings is the second most common mistake. A search result tells you that a piece of content exists somewhere on the internet. It does not verify the content’s accuracy, establish its original context, or confirm that the source is what it appears to be. Every result that matters needs to be evaluated, not just collected. The speed at which results come back can create a false sense that the work is moving fast. Collecting faster is not the same as investigating better.

Over-reliance on a single tool or a single source produces narrow coverage that looks complete because you do not know what you are missing. The practitioner who only uses Google, who only checks 1 social media platform, who only consults 1 database, has investigation-shaped blind spots they are not aware of. Building the habit of asking what you have not checked is as important as developing skill with the tools you have.

OSINT Username Tools

Failing to document as you go is recoverable in small investigations and increasingly costly as investigations grow. The instinct to document after the fact, once the work feels done, produces incomplete records and introduces errors from memory. Document during collection, not after.

Confusing volume with thoroughness is a trap that produces deliverables nobody can use. An investigation that has pulled every possible result across every available platform, without any analytical layer distinguishing what matters from what does not, is not a thorough investigation. It is a data dump. Thoroughness is defined relative to the question being answered, not relative to how much was collected.

Sharing unverified information because it seems credible is a reputational risk that compounds over time. In a field where accuracy is the professional currency, the practitioner who consistently pushes unverified claims because they look plausible erodes their own credibility faster than almost any other mistake. Verify before you share, and be explicit about what has not been verified when you share it.

What Good Habits Look Like Early

The practitioners who develop well are the ones who slow down at the beginning of an investigation rather than racing to collection. They write the question down. They think about what sources would be relevant and why. They note what they do not know before they start looking for what they do. They document as they go. They distinguish between what they found and what it means.

Intro to Intelligence Report Writing

These habits feel slower than just opening a browser and starting to search. Over the course of a real investigation, they produce better results in less total time, because they prevent the rework that comes from collecting in the wrong direction and the credibility damage that comes from advancing findings that do not hold up.

The practitioners who skip these steps early tend to hit a ceiling. They get fast at collection and the outputs look like a lot of work, but they cannot make the jump to producing something that actually serves the person who asked for it. The ceiling is not a talent problem. It is a habit problem, and it is much easier to build the right habits at the start than to rebuild them after years of working a different way.

The posts on this publication about the intelligence cycle, source reliability, and writing a proper intelligence requirement are not abstract theory. They are the framework that these habits are built on. If any of them felt like they were describing a discipline you wanted to develop, you are in the right place.

Some links in this post may be affiliate links. If you purchase through them, I may receive a small commission at no additional cost to you. This helps keep the blog running and the content free.

Subscribe now

OSINT Techniques for Verifying AI-Generated Media

Joe Gray — Tue, 16 Jun 2026 12:02:15 GMT

A year ago, identifying AI-generated media was largely a matter of looking for obvious tells. Hands with too many fingers, text that dissolved into nonsense, faces with an uncanny waxiness. Those tells still exist in lower-effort generations, but the top tier of image and video generation tools has improved to the point where casual visual inspection is no longer a reliable filter. For OSINT practitioners, that shift matters. Verifying whether an image or video is AI-generated is no longer a niche skill. It is becoming a standard part of source evaluation, and it connects directly to the disinformation tradecraft covered in recent posts on this publication.

This post covers where the verification process stands right now: what metadata can and cannot tell you, what visual artifacts are still worth checking, why reverse image search behaves differently with AI content, and what the emerging detection tools can and cannot be trusted to do.

Subscribe now

Metadata Analysis

Metadata is often the first thing practitioners check and the first thing that gets stripped or altered, intentionally or not. Most images shared on social media have already lost their original EXIF data through platform compression and re-encoding, which means the absence of metadata tells you very little on its own. A real photograph shared through a messaging app and then re-uploaded to a forum will often arrive with no more metadata than an AI-generated image.

Photo by Steve A Johnson on Unsplash

What metadata can sometimes provide is a positive signal in the other direction. Some AI generation tools embed identifying information, either through the C2PA Content Credentials standard, which a growing number of platforms and generation tools support, or through tool-specific metadata fields that survive at least the first round of sharing. If an image carries C2PA credentials indicating it was generated or edited by a specific AI tool, that is strong evidence. The catch is that this metadata is easy to strip, either deliberately or as a byproduct of how an image gets re-saved, screenshotted, or re-compressed during sharing. Its presence is meaningful. Its absence is not.

For video, container-level metadata can sometimes reveal the software used to create or render a file, which is occasionally useful when that software is itself an AI generation tool rather than standard editing software. This is inconsistent enough that it should be treated as a secondary check rather than a primary method.

The practical takeaway is that metadata analysis is worth doing because it occasionally provides a clean answer, but a negative or empty result should not be read as evidence that the content is authentic. It just means the metadata did not help.

Visual Artifacts and Inconsistencies

Despite the overall improvement in generation quality, certain categories of artifact remain useful, particularly in video and in images with complex scenes.

Hands, teeth, and ears remain disproportionately difficult for image generators to render consistently, especially in scenes with unusual poses or partial occlusion. This is less reliable than it was, but in a meaningful percentage of generated images these details still show subtle errors: an extra joint, asymmetry that does not match how the body actually works, teeth that do not align with the jaw structure.

Text rendering within images has improved substantially but still produces errors under scrutiny, particularly with text on signage, labels, or background elements that were not the focus of the generation prompt. Letters that are almost but not quite correct, logos that are close approximations of real brands but subtly wrong, and text that becomes incoherent at the edges of the frame are all still common.

Reflections, shadows, and lighting consistency are some of the more durable signals because they require the generator to maintain physical consistency across the entire frame, which is harder than getting any single element right. Check whether shadows fall in directions consistent with the apparent light source, whether reflections in glass, water, or mirrors show the same scene that is visible directly, and whether lighting on a subject’s face matches the lighting on their surroundings.

For video specifically, temporal consistency is the area where artifacts are most likely to appear. Background elements that subtly shift or warp between frames, hair or fabric that moves in ways inconsistent with physics, and faces that show small inconsistencies frame to frame even when any single frame looks convincing. These artifacts are often invisible at normal playback speed and become apparent when stepping through frame by frame or slowing the video down significantly.

Edge artifacts around the boundaries of people or objects, particularly where a subject meets a complex background, can show telltale blurring, color bleeding, or unnatural smoothness that differs from the texture of the rest of the image.

None of these signals is individually conclusive. The practical approach is the same as with any other OSINT verification task: look for a cluster of small inconsistencies rather than expecting one obvious tell, and weigh the cumulative picture rather than dismissing a single anomaly or treating a single anomaly as proof.

Reverse Image Search Limitations

Reverse image search is one of the most reliable tools in the OSINT toolkit for verifying real photographs, and it behaves very differently with AI-generated content in ways that practitioners need to account for.

Photo by Nicolas Ladino Silva on Unsplash

When a real photograph has been used before, reverse image search can often find the original context, the original date, or prior instances of the same image being used in a different setting. This is the core mechanism behind a large portion of image verification work.

AI-generated images generally will not return prior instances through reverse image search, for the simple reason that the image did not exist before it was generated. A practitioner running a reverse image search and getting no results might interpret that as the image being original and therefore more likely authentic. With AI-generated content, the opposite can be true: a lack of any prior instances is consistent with both an authentic original photograph and a newly generated image, and reverse image search alone cannot distinguish between those two explanations.

There is a secondary use case that remains valuable. If a reverse image search does return a result showing the same image, or a very similar one, associated with an AI image generation platform, a prompt-sharing community, or a stock AI-image marketplace, that is strong evidence of AI origin. The search is not finding the “real” version of the image. It is finding evidence of the image’s existence within AI-generation ecosystems.

The broader point is that reverse image search needs to be understood as a tool that answers a different question for AI-generated content than it does for real photographs, and practitioners need to adjust their interpretation of both positive and negative results accordingly.

Emerging AI Detection Tools

A growing category of tools is being built specifically to detect AI-generated content, and the practical reality is that these tools are improving quickly but remain inconsistent, particularly across different generation models.

Detection tools generally work by analyzing statistical patterns in the image data that are characteristic of generation models, looking for the kinds of artifacts that generation processes tend to leave behind even when they are invisible to the human eye. Some tools focus on specific generation models and perform well against those models while performing poorly against others. Detection accuracy also tends to degrade significantly once an image has been compressed, resized, or re-encoded, which describes the vast majority of images encountered in real investigations.

The practical guidance for using these tools is to treat their output as one data point among several rather than a verdict. A detection tool returning a high confidence score that an image is AI-generated is meaningful and worth weighing heavily. A detection tool returning a low confidence score is much weaker evidence of authenticity, because it may simply reflect a generation model the tool was not trained to detect, or an image that has been processed in ways that obscured the relevant signals.

For video, detection tools generally analyze either individual frames using image-based methods or look for temporal artifacts across frames. The same caveats apply, with the added complexity that video compression is typically more aggressive than image compression and can further degrade the signals these tools rely on.

The detection tooling landscape is moving quickly, and tools that perform well against current generation models may perform poorly against models released six months later. This is not a space where a practitioner can learn a tool once and consider the skill set complete. Staying current with what tools exist and what their actual performance looks like against current-generation AI media is part of the ongoing work.

Why This Matters for Disinformation Tradecraft

The disinformation investigations covered in the previous post on this publication rely on establishing the authenticity and origin of content as a foundational step. A narrative built around a fabricated image or video is a different investigative problem than a narrative built around a real image used in a misleading context, and getting that distinction right at the start shapes everything that follows.

As AI-generated media becomes more difficult to distinguish from real content through casual inspection, the verification step becomes both more important and more demanding. The practitioners who treat this as a checklist item, running one tool and accepting whatever it returns, are going to miss things. The practitioners who understand what each method can and cannot tell them, and who weigh multiple imperfect signals against each other, are the ones whose assessments will hold up.

This is not a problem that gets solved once. The generation tools keep improving, the detection tools keep adapting, and the gap between them keeps shifting. Building the habit of methodical, multi-method verification now is what keeps a practitioner’s tradecraft relevant as that gap continues to move.

Some links in this post may be affiliate links. If you purchase through them, I may receive a small commission at no additional cost to you. This helps keep the blog running and the content free.

Subscribe now

Using OSINT to Investigate Disinformation Campaigns

Joe Gray — Tue, 09 Jun 2026 12:02:24 GMT

Using OSINT to Investigate Disinformation Campaigns

Disinformation is not a new problem, but the scale at which false narratives now spread and the infrastructure that supports their spread has change…

Reading the Wild: Flora and Fauna as OSINT Signals

Joe Gray — Tue, 02 Jun 2026 12:01:34 GMT

Reading the Wild: Flora and Fauna as OSINT Geolocation Signals

Most geolocation work in OSINT focuses on the built environment. Street signs, architecture, road markings, storefronts, utility infrastr…

AI-Assisted Research Personas for OSINT Investigators

Joe Gray — Tue, 26 May 2026 12:01:09 GMT

AI-Assisted Research Personas for OSINT Investigators

Research personas have been part of investigative and intelligence work for as long as both disciplines have existed. The practice predates OSINT …

Source Reliability Is Not a Property of the Source

Joe Gray — Wed, 20 May 2026 12:03:36 GMT

Most OSINT practitioners think about source reliability the wrong way. Not because they are careless or untrained, but because the mental model the community defaults to is built on a flawed premise:…

IIRW: Introduction to Intelligence Report Writing

Joe Gray — Tue, 19 May 2026 19:52:46 GMT

Knowing how to analyze is not the same as knowing how to communicate analysis. A significant amount of OSINT work breaks down at exactly that seam. The practitioner has done solid collection and soun…

AITI: Accelerated Introduction to Intelligence Course

Joe Gray — Tue, 19 May 2026 19:46:43 GMT

There is a persistent gap in how most OSINT practitioners develop. Collection skills get taught early and reinforced constantly through tools, tutorials, and community practice. The analytical layer …

OSINT using Recon-NG

Joe Gray — Tue, 19 May 2026 19:41:15 GMT

Recon-ng is one of the more capable tools in the open source intelligence stack and one of the most inconsistently taught. Most practitioners who use it learned just enough to run a few modules and s…

OSINT USERNAME TOOLS

Joe Gray — Tue, 19 May 2026 19:35:45 GMT

Username investigation is one of the first skills most OSINT practitioners develop and one of the least systematically taught. The typical approach is to throw a name into a few familiar sites, see w…

The INT in OSINT: Why the Community Stops at Collection

Joe Gray — Wed, 13 May 2026 12:02:44 GMT

The INT in OSINT stands for intelligence. Most practitioners in this space know that. Fewer of them act like it.

Open source intelligence has spent the better part of the last decade building out an i…

AI Tools in OSINT: Where They Help and Where They Fail

Joe Gray — Wed, 06 May 2026 13:02:48 GMT

There is a version of this post that tells you AI is going to revolutionize OSINT. There is another version that tells you AI is a fraud and real analysts do not need it. Both of those versions are l…

OSINT Technique Spotlight: Google Dorking

Joe Gray — Tue, 08 Nov 2022 13:01:07 GMT

If you’ve been around OSINT or even Infosec, both red and blue, for a while, you’ve probably heard of Google Dorking or Google Hacking. There is no difference in the terms, aside from some audiences …

DuckDuckGo's Tracking Disabling and Disposable Email Services

Joe Gray — Thu, 22 Jul 2021 13:45:45 GMT

Background

As some of you may know, Spread Privacy, the parent company of the DuckDuckGo search engine, announced on 20 July 2021 two new services. The first is similar to the disposable email address…

Open Source Intelligence, OPSEC/Privacy, Disinformation, and Data Science and the impacts they have on society.

Joe Gray — Fri, 04 Dec 2020 20:12:53 GMT

Welcome to The OSINTion Tidbit by me, Joe Gray. Joe is passionate about exploring Open Source Intelligence, Privacy, Disinformation, and Data Science and the impacts they have on society.

Subscribe now

In the meantime, tell your friends!

New Threads, New OSINT — An exploration of Poshmark

Joe Gray — Tue, 25 Aug 2020 13:01:01 GMT

I was tossing around ideas for a blog about Poshmark. My first inclination was to check Micah Hoffman’s WhatsMyName tool (also available as Profiler in Recon-ng and as a Web Application). The tool ha…

Browsers for Privacy, OPSEC, and OSINT

Joe Gray — Sat, 22 Aug 2020 21:20:05 GMT

When doing an OSINT or OPSEC/Privacy investigation, not all browsers are created equal. Despite our best efforts at anonymity, they can have unfiltered access to what we are viewing. Depending on the…

Introducing WikiLeaker — An OSINT Tool for Searching WikiLeaks

Joe Gray — Wed, 15 Apr 2020 15:01:00 GMT

The Internet Archive Is Being Used As A Disinformation Mule

Joe Gray — Wed, 15 Apr 2020 10:01:00 GMT

As the world continues to battle the COVID-19 pandemic, some outlets are sharing samples of malware, while others are trumpeting politically biased information from both sides of the proverbial aisle…

Building My Home Lab: Part 1

Joe Gray — Fri, 10 Jan 2020 11:01:01 GMT

Photo by panumas nikhomkhai from Pexels

I have been collecting old computers from friends and family for some time, and I always said that I was going to stand up a lab. I have finally started to put …