Getting started with OSINT: from question to evidence

Start with a small enough question

OSINT uses publicly accessible information to answer a question. A municipal timetable, a photograph published by its creator or an archive document can provide a starting point. Public availability does not guarantee accuracy or make every reuse appropriate.

For a first exercise, choose a public, low-risk subject: the history of a monument, the date of an exhibition or the origin of a landscape photograph. ‘What do we know about this place?’ can take you anywhere. ‘What reopening date does the museum announce in its latest notice?’ gives you a target and a stopping condition.

Write the question before searching. Specify what is outside your scope. Investigating a building does not require identifying people walking past it. Set a research time as well: twenty minutes is enough for this first attempt. An incomplete answer with clear reasoning is useful; improvised certainty is not.

Separate what you see from what you infer

‘The page displays 4 May’ is an observation. ‘The event takes place on 4 May’ is an interpretation. The date could refer to publication, an update or a previous event. This small change can send the rest of the investigation in the wrong direction.

Keep two columns: observation and hypothesis. In the first, preserve the useful wording, the page and its context. In the second, write your provisional explanation. A third column, ‘how to check’, turns uncertainty into a next action.

Look for something that could contradict your hypothesis. If you think you have identified a building, check its surroundings too. If a fixed feature visible in other views is missing, explain the difference before reaching a conclusion.

Look for a source, not just an answer

Search results are leads. Open the document and read around the excerpt. Check who published it, what it concerns and the period it describes. A prominent result may concern last year’s edition of an event.

For an announcement, start with the organisation’s exact name and the subject. Search a distinctive phrase in quotation marks. Too few results? Remove one detail at a time. Too many? Add the location, year or document type. Record useful query variations so you can retrace your route.

On the organisation’s website, find the original section: news, minutes, archives or events. A page in a dated series offers context that a detached excerpt does not. A dead link is a limitation to record, not a reason to guess its contents.

1. Name the subject and the responsible organisation.
2. Open the document beyond the search excerpt.
3. Distinguish event, publication and update dates.
4. Keep the reference and the passage that answers your question.

Three pages may still be one source

One website publishes a press release. Two blogs repeat it almost word for word. There are three pages, but only one origin for the claim. Draw their relationships: who cites whom, who adds a new observation, who merely passes the statement on?

Independence concerns the information, not just the domain name. A separately taken photograph and a document from the responsible organisation can complement each other. Two articles based on the same press release are not two independent confirmations of it.

An official source is useful for establishing what an organisation announces. It does not, by itself, prove that the announced event took place. Match the conclusion to the source’s scope: announcement, observation or retrospective account.

Keep a small, usable evidence trail

For each decisive item, keep a title, public URL, consultation date and a short note explaining what it establishes. A screenshot may help when a page changes. Keep enough context to show what was captured.

Do not turn a learning exercise into a collection of personal information. Remove unnecessary personal details from screenshots you share. Do not copy an entire database when one public document answers the question. Respect access restrictions and the rights attached to the material.

If two items contradict each other, keep both. Record their dates and relationship. Removing the inconvenient item may make a conclusion look tidier, but it also makes it weaker.

Write an answer that works without your tabs

State the answer, then the two or three items supporting it, then the limitation. For example: ‘The latest notice announces reopening on 12 May. It replaces an earlier announcement for 10 May. I have no evidence of the actual reopening.’ Each sentence does a different job.

You can describe your confidence if you explain the reason: strong for an explicit dated announcement from the responsible organisation; weaker for an inference from a partial photograph. A precise percentage adds little without a method for calculating it.

Before closing the file, ask whether someone else could find your evidence and follow the reasoning. If they could, you have produced a useful result even when part of the question remains open.