Blog
Notes on method, tooling and worked examples from open-source investigation practice.
Case studies · 19 October 2026 · 4 min read
Five reports can still be one account
I split 36 FORGE pins into 216 facts. The useful result was not a confidence score, but a clearer account of who said what, and what remains unknown.
verificationsource tracingcorroborationmachine outputCase studies · 17 October 2026 · 5 min read
Checking the check: two mistakes in my own work
I audited a machine's report, then rebuilt it with stricter checks. My audit and my rebuild each held a mistake. Here is what they were and how to correct work in public.
verificationclaim checkingcorrectionsmachine outputCase studies · 13 October 2026 · 7 min read
A polished report is not a checked report
I let my own OSINT engine write a brief on an arrest, then checked it by hand. The arrest was real, but much around it did not hold up. This is what the human step found.
verificationmachine outputclaim checkingMethods · 12 October 2026 · 5 min read
Same handle, different person: the trouble with username matches
Username search tools tell you a page exists, not who owns it. Here is how to weigh handle matches, spot false positives and false negatives, and avoid naming the wrong person.
usernamesidentity resolutionfalse positivesverificationMethods · 12 October 2026 · 6 min read
Where was this taken? Start with what cannot move
How to work out where a photo was taken: collect clues, rank them by how permanent they are, test candidate places against every clue, and say how sure you are.
geolocationverificationmapsshadowsMethods · 11 October 2026 · 5 min read
A photo's metadata is a witness, not a verdict
What hidden file data can tell an investigator, what it cannot, and the habit that keeps you honest: test it, then corroborate it.
metadataexifverificationgeolocation