In this video we're going to talk about OSM steps.
Now this is also I want to say a pre-recorded video.
Some students have said that some of the audio quality was inconsistent.
So I'm rerecording a number of videos to try to correct that problem.
And a big shout out to Tony, one of the students that actually took the time to outline which videos
were having issues because whatever reason, I, I don't see those issues on my end.
But I do believe that, you know, I have several people said that they did have some problems with
it.
So that's why we're rerecording these videos that were outlined.
Now Osint steps, when we start an investigation, we're going to take several steps in order to conduct
our investigation.
And we're always going to have a starting point.
So the main thing is what's our goal and what's our starting evidence.
So things like, are we doing an investigation on doing a background check on someone?
Are we fact checking something?
Are we trying to track down a, uh, someone that maybe, uh, is on the run, a criminal on the run,
a missing person, uh, any number of things.
So again, we want to find out what our goal is.
We want that defined and also what our starting point is.
Do we have a name?
Is there a event that that we're starting with a username, a video, social media post ransomware attack,
virus attack, missing person, email domain, phone number, photo, news story, email, potential
threat, person of interest, uh, the list goes on and on.
But these are some basic starting points, uh, that you that you may have.
So say we have a social media post that we want to investigate.
In this case, we have this, uh, This post here.
Update.
Many, many of you said that heard about TRB black checks we shared yesterday, this image of Donald
Trump signing them, blah blah blah and say we want to investigate if this is legitimate or not.
Well, our starting point is this social media post.
So we'll go into this much more in depth throughout the course.
But to give you kind of a brief overview, certain steps I would take, I would take down whose account
is this, the logos on it.
When did they create an account?
When was this posted?
Who were they friends with?
Who are they following?
Who's following them?
What post did they make?
Copy all this text here.
Save a copy of this.
Save the image.
Take a look at the image and I could tell the image is pretty poorly photo manipulated, because the
supposed checks that he's signing looks way off.
This looks all cropped in that and whatnot.
And again, we'll get into this more in depth throughout the course.
So again, your steps.
You want to start outlining the steps that you're going to take.
And having those steps is going to help you with your investigation.
Not only save you time, but it could also help you with your integrity of of your investigation.
And integrity is absolutely important in any investigation.
And having the ability to outline exactly what steps you took will go a long way, especially if that
has to get entered in as evidence.
Things like analyze the story for information.
Can I verify the original poster's credibility?
Research what the TRB Blackjacks are.
Investigate the links given in the post.
If there's a URL, do a domain lookup and see who owns those domains, do reverse image searches, and
so on and so forth.
Now another thing is, um, we may have these different steps in our head, but it is always good to
have some sort of checklist, whether it's a checklist you go off of or you start drafting out a checklist,
say we start checking off things one by one, and this will help not only organize your thoughts, but
also make sure that you don't miss a step, because it is pretty easy to miss a step because we may
start following a piece of evidence, and then we get so caught up in that we forget another step.
So outlining your different steps that you're going to take is is a good idea.
And we may even add stuff to that to our list.
And we may remove things from that list.
And that's fine because we need to remain fluid in in our investigation because things may change.
The evidence that we have may not be what we thought it was going to be.
It may take us in directions we never we didn't expect.
So keep that in mind.
And for investigations.
I like using either CSI Linux because it has a great number of tools in there to use right off the bat,
and we'll be using that during this course or I, I also use a custom Linux distro.
I have a base install of Debian Linux and I, I modified it to what I need.
So and you may end up doing that later on.
Um, either way is totally acceptable.
It's going to be a matter of what's going to work for you best.
And again, going back, taking something like this, doing a reverse image search.
This is the original image of what it what that picture came from.
And you can see that the photo looks very different from from this versus that kind of weird images
of those black checks where the edges didn't look quite right, the lighting was off, things like that.
And that's that's what you're flying with, like reverse image searches.
And towards the end of our investigation, we always want to make sure that we have a report to write,
and a report is good, whether you're giving it to a lawyer, if it's being entered in a court, to
an employer, whatnot, having a report is good because we can compile the information.
We can put all that information into a readable, digestible report for people.
And this is good for our records and also for, again, if we're doing a criminal investigation, things
of that nature.
It's good to have a report to be able to hand off to someone.
And it's really good for management and upper management to be able to look at that, that if they want
to get involved with it or something happens, do you have a report to hand over?
And it's again, it's a much more professional way to go about it.
So this was about OHS and steps.
And again, we'll be diving into much more details about these individual steps as the course progresses.
Thank you so much for watching.
I'll see you in next video.