In this re-recorded video I'm going to go over a OSINT template and also another
document that I'm currently using. Now first off I do want to say this is a
re-record so I apologize to anyone that actually looked at the video probably
late last night early this morning today and had issues with it. I do appreciate
the student that reached out to me and let me know that there was a problem.
Again I apologize and this is a re-recorded video. So it's important to
have a documentation for your OSINT investigation. This is a basic template
that I have. I'm going to put this on the Google Drive along with the other
document. Feel free to use it, modify it, things like take out go ahead and take
out my header here. I can't imagine was going to use my DGS header if you're
doing it for your own OSINT investigations and whatnot. And there are
other templates out there. There's free ones out there. There's ones you could
have AI build. This is a generic one I had AI initially build and I went ahead
and edited it. And there's also templates built into things like CSI Linux. However
using it it does some great jobs pre-populating things but also it's kind
of a pain when I used it for other stuff. So for me personally I find it easier to
just take a template like this and kind of modify it like I need to. So let me
kind of go over this for you to give you an idea how these reports work. So I have
my logo here. Private Investigation Report Identifier. So case ID or target
name. Status. Is this a preliminary search or is this a final report?
Classification Private Restricted Distribution which is probably going to
be the case for most your OSINT investigations. It is going to be
confidential and private. Executive Summary. So a quick summary about hey
what's the objective? What was the point of this report or investigation? And some
brief key findings. What are some of the most important things that you discover
during your investigation? And the Executive Summary is really important
for to give people like the higher-ups a quick view because a lot of times they
may not understand what they're looking at or don't have time or a little bit of
both. So having that Executive Summary makes a big difference. Now Subject
Identity Profile. What's their full legal name if you know it? Where their
aliases, maiden name, nicknames, common name variations. Primary handles. Things
that they use across say social media platforms and whatnot. What's their
estimate location? City, state. Now it's estimated normally because a lot of
times we're not positive where these people reside or where they're currently
operating in. So estimate location is a pretty basic way to put it. So next up we
have things like digital footprint and social media and there's some pretty
basic ones up in here. LinkedIn, X, Twitter, Facebook, Instagram. Additional
URLs. So if I find my target aren't things like say Blue Sky or
Upscroll, things like that. TikTok. I could fill in these and I always could
add more boxes as needed as I find more social media platforms that they're on.
So what's their handle or username? What's the direct URL associated to
those accounts? What's their status and what's their other information that
that's going to be relevant? Friends, family, anything that's going to be
important populate in that other box. Professional history, workplaces, things
like, okay, where do they currently work? What's the company's name?
What's their role? What's the company's, say, business ID? Who owns it? What were
their past employments? Company name, what was their role? How long were they there?
When were they active there? Things like that. Property and physical assets, things
like, do they have a address? Do they own a home? Do they own a vehicle? Do they
own a boat? Do they have any rental history, rental properties and trusts?
Things like that. And what's the asset value? Now, you're not going to fill that
out for every investigation. This is going to be for things like, say, if you
need to get information on someone and find out their basic worth or if they
have anything unusual, like, hey, that's strange. This guy that has no real job,
he works at, or I should say, this person works at, say, a fast food restaurant
and he's a fry cook, for example. Yet, well, that's odd. He's driving a
Lamborghini and that's registering his name. Things like that, you put in there
and you put the approximate value, because that's really unusual and having
that value can help with your investigation. Associated assets,
vehicles, secondary property, land parcels, et cetera. And additional notes.
So that's going to be important because there's always going to be that kind of
outlier information that you get that's going to be important for your
investigation, or at least you feel it may be really important. So you want to
have additional notes there. We also have, and actually these numbers need to
be changed, but investigation findings narrative, things like explain the data
points that you found during your investigation. Things like, well, I found
their LinkedIn profile and that confirmed their employment at this
company and that company is associated to this other thing I found. Things like
that. Kind of how the information connects to each other. Evidence logs and
sources. So things like anything additional that you have.
Things like company URLs, other information, pasted URL and the dates on
there. And conclusion recommendations, final assessments, high, medium, low
confidence in your findings. How confident are you about the information
that you put in the report? Are you able to validate that information? Is a lot of
it speculative? You want to kind of put down, well, okay, my confidence rating is
medium because of this. My confidence rating is high because I was able to
validate it and verify in this. Recommended actions. And of course, your
name, lead investigator name. You can put other investigators on there and date of
completion. And also you want to put the date started and whatnot. But again, this
is a basic template. Again, go ahead and feel free to use this if you want. Modify
it however you need it for your particular use case. Because I do say basic
because when it comes to investigations, chances are you are going to change
things up depending on what your investigation, add more stuff, take some
stuff out, things like that. A lot of times it's not a one fits all. So again,
that's why you want a document that you can edit and tailor to your needs. So
that was the report template. And this is another one. So OSINT services, client
intake and case scoping. Now, I really wish I did this years and years ago when
I started doing investigations because this kind of thing drives me nuts. So
someone may come to you and go, hey, I need you to do an investigation. I need
you to take a look at this one person. I think they may be doing something really
shady. I think they might be, say, DDoSing our network. I need you to just kind of
dig in there and figure out, yeah, are they potentially doing illegal stuff? And
here's their name. And you go off and you start your investigation. You start with
a name and kind of what they think might be going on with them. And you spend
hours, you spend days or weeks collecting this information and trying to connect
the dots there. And you come back and you might get, they might come to you during
your investigation before you finish. You go, hey, how's your investigation going?
You go, well, okay, well, it's going pretty good. So I got from that name, I
figured out, hey, this is their, this is their username on X. And I found this bit
of information about them and this. So I'm going on, I'm validating that
information. It took me a little while to validate that, that this person on X is in
fact them. And this other information is in fact related to them. And the person
that gave you that investigation, oh yeah, I knew that already. And you kind of slap
your head and go, well, if you told me that you knew this, you know, certain
information before I start this investigation, that could have saved me a
whole lot of time and it could have saved you a lot of time. And I could have made so
much more progress in this investigation right off the bat. So for whatever reason,
people don't always give you the information that they know, whether it's,
I don't know, maybe they're testing you or maybe it doesn't occur to them that,
oh, I should tell them, you know, as much information as I know, or sometimes
investigators may feel like, well, you know, my job is doing investigation. I
should really find out this information. Don't feel that way. If someone's going
to you with an investigation, find out as much as you can from that person,
because that will give you a so much better starting point. When you do your
investigation, the more information you have, the better. And of course, taking
that information, you do want to validate that what they know is in fact going to
be true or not. Now, something like this goes a long way towards that. So this
essentially is a intake case scoping. So this is designed to give, give to your
client so they could fill this out and give you information to help you with
your start of your investigation. So case reference, a date of intake, primary
investigator, again, modify this as you need. So client information. So
information about your client. First of all, Hey, what's their name? What's their
organization? What's the primary contact? What's the phone number? Secure
communication that you want to, that you're going to communicate with. What's
their email? Encrypted preferably. Things like ProtonMail is, is great. Things
like that. What type of investigation? Legal wise, is it for litigation, due
diligence, safety, something else. Kind of gives you an idea of, you know, how, how
you, how you approach this. The short answer is you should approach every
investigation as that it may end up in court and you always want to do things
legally. And I'm not saying that in quotes. Really you do want to do your
investigations legally because the last thing you need is to get sued, have your
investigation thrown out because you did something illegal. Like, Oh yeah, I logged
in their account because I found, I found their password on their dark web. No, you
can't do that. So again, always remember to do things legally and depending on
your state, country, things like that, that's going to vary. So keep that in
mind. So subject seed data. This is going to be for your client to fill out.
Please provide as much known good information as possible to prevent false
positives. Individual subject or subjects, full legal name and known aliases. If
they know what their name is, if they know what their alias is, if they don't
know any of these questions, then don't worry about it. Tell them not to worry
about it. It's okay. Just fill out as much known good information as they have.
A date of birth or approximate age, known locations, current and past, phone
numbers, primary email addresses, known emails, social media handles, a
significant associate or partners, people that associate with business entity,
subjects, legal names, DBAs, registry, registration, state, country, any domains
or URLs that they're associated to, and any additional information that they want
to share with you. And they can also fill this out, check all that apply. Tier
one, what type of investigation is going to be? Tier one, surface web presence,
social, things like, hey, I want you to check out the social media, check the
news, do a basic search on them. Just give me some very surface level
information about this person or these people, this organization, whatever. Tier
two, deep web, public records. Well, this gets a little bit deeper. Start
checking property records, court filings, business registrations and whatnot. Tier
three, dark web data leak analysis. In this regard, I'm going to go into and
start looking at breach data. Hey, do they show up in any of these breaches? Are
they mentioned in any dark web forums? Is there any PII leak exposures? Tier
four, network and technical intelligence. This might be a investigation on domain
structure. What can you see? Are there any potential vulnerabilities on a website
or domain? IP history, who is look up, things like that. Tier five, financial
asset discovery. Hey, what can you find out about this person or organization?
Vehicles, vessels, records, filings, professional licenses, et cetera. And they
may have you do one through five, or they may have you do, well, I want surface
web and I want a network discovery. So one in four. So up to your client. Terms
of disclosure, passive methods only. Unless explicitly agreed upon, all
research is passive. The investigator will not contact the subject or use
pretexting, social engineering. Password resets, contacting the subject or
subjects, use of found passwords, et cetera. So most of the time, most
investigations are going to be passive, especially if you do not want your
target being aware. So again, unless specifically agreed upon, it's going to
be passive. Data limitation. Intelligence is provided on an as-is basis based on
available open sources. Information can be deleted, falsified, obscured by the
subject or other factors. So basically you're telling your client, hey, I'm
pulling the information that I find. I'm going to try to validate to the best of
my ability. However, there may be false positives. Some of the reports that I
pull may not be accurate. Some of the information the target may have
intentionally put bad information out there. Things like myself, I put different
names, different phone numbers, different addresses. Sometimes I'll throw in a
middle name that's not my middle name just to screw with the information when
people start looking for me. Things like that. That can happen. And again, you try
to do your best to validate that information. But again, there can be bad
information, whether it's intentional or unintentional. So that's why you tell
your client, hey, this is on an as-is basis. I will do my best to validate that
information. However, there is still a chance that that information is not
going to be accurate. Confidentiality. Both parties agree to maintain a
confidentiality of the investigation findings and the methods
used. Confidentiality and privacy is huge when it comes to doing open source
intelligence and investigation. So keep that in mind. Authorization. Authorized
budget cap. If you are getting a budget, if someone is paying you and going, I
will give you resource, I will give you X amount of money to do your
investigation because you may need things like, well, okay, hey, I'm going to
use this service to try to do a background check. It's going to cost as
much. I'm going to do, I'm going to go through a business filings, but they
want $25 to get those records. So I am going to need a budget for that. Also,
if you have a budget cap, you put that down there. Target delivery date. When
you expect to deliver the information or what the hard stop is. Client
signature and date and investigator signature and date. So again, these are
just some basic templates and questionnaires to help you with your
investigations. Hopefully you found this useful. Thank you so much for watching.
I'll see you next video.