How to Conduct Open-Source Investigations: A Beginner’s Guide

Before searching anything, define precisely what the investigation is trying to establish. Three questions structure this: What specifically is being investigated — a person, an institution, a transaction, an event? What kind of evidence would be considered credible proof of the specific allegation or question? What time frame and geographic scope are relevant?

A clear objective does more than focus the research. It determines what counts as a relevant finding and what counts as an interesting but unrelated data point. Investigations without a defined objective tend to accumulate information rather than produce evidence — a distinction that matters when the findings are eventually presented to a public, a publication, or a legal proceeding. The objective also defines the threshold for when the investigation is complete: not when all available information has been gathered, but when the specific question has been answered to the required evidentiary standard.

A research plan maps the sources most likely to contain relevant information and the specific search terms, names, dates, keywords, and organizational affiliations that will guide the search. It identifies which phases of the investigation can proceed in parallel and which depend on information gathered in earlier phases. It establishes a realistic timeline and acknowledges that some investigations will require multiple phases as initial findings generate new questions.

The research plan is also where the investigator thinks through the connection architecture of the subject: what names, companies, locations, and relationships are likely to appear in the public record, and which databases are most likely to document them. A person of interest who appears in court records, property records, campaign finance filings, and business registrations will leave a documentable pattern across multiple independent sources — and mapping those connections in advance makes the search faster and the findings more robust.

Official records provide the evidentiary foundation that distinguishes a documented investigation from an opinion. The most consistently useful categories for accountability investigations are court records — civil lawsuits, criminal case filings, bankruptcy proceedings, and related exhibits — which often contain financial disclosures, sworn testimony, and document production that would be otherwise inaccessible. Business registrations and financial disclosures identify ownership structures, registered agents, and financial relationships. Property records link real estate holdings to individuals and organizations and can document asset transfers that are relevant to financial misconduct investigations. Government audit and regulatory violation reports document how agencies have assessed compliance and what violations have been found. Campaign finance records — available at the state and county level in Michigan and most other states — document financial relationships between candidates, officeholders, and donors that may be relevant to understanding enforcement decisions and institutional relationships.

Many of these records are available through online government portals. When online access is unclear or unavailable, a direct call to the relevant clerk’s office often clarifies what is available, what form it is in, and what the process is for obtaining it — including whether a FOIA request is required and what the typical response timeline is.

Social media is a significant OSINT source, but it requires more careful handling than official records because its content is more susceptible to fabrication, manipulation, and disappearance. Public posts — those visible to anyone without a login — are generally available for OSINT use. Deleted posts and archived content may be accessible through services like the Wayback Machine or specialized archival tools; content should be captured and preserved as early as possible in the investigation because social media is volatile.

Profile information on social media should be cross-referenced with other public records rather than accepted at face value. People misrepresent their credentials, affiliations, locations, and timelines on social media, and claims that cannot be verified through independent sources should not be treated as established. Digital images often contain embedded metadata — timestamps, geolocation data, device information — that can be extracted using freely available tools and that may be relevant to establishing when and where an image was captured. This metadata should be documented when present.

The most important discipline with social media OSINT is verification: a social media post showing something is a starting point for inquiry, not a conclusion. Before including social media evidence in any published or reported finding, it should be verified through at least one independent source that does not depend on the social media content itself.

Verification is the step that converts collected information into credible evidence. A single source establishing a fact is a lead. Multiple independent sources establishing the same fact — particularly when those sources have no connection to each other — are a finding. The independence standard matters: if three sources all derive from the same original document or the same person’s account, they are not three independent confirmations. They are one source repeated.

Verification also involves actively seeking disconfirming evidence — information that would contradict or undermine the investigation’s emerging conclusions. An OSINT investigation that only looks for evidence supporting what the investigator already suspects will miss material that could change the conclusion. The discipline of actively seeking disconfirmation is not a sign of weakness in the investigation. It is what makes the investigation defensible when the findings are challenged.

Every step of an OSINT investigation must be documented with enough specificity that another person could follow the same path and reproduce the findings. This means recording the sources searched, the URLs of documents accessed, screenshots with timestamps of web content that may change or disappear, the dates on which materials were accessed, and the chain of custody for any digital evidence. It means keeping a log of search terms used, results reviewed, and findings recorded. And it means noting what was searched but not found — negative findings are part of the evidentiary record too.

Documentation serves two functions simultaneously. It enables others to verify the findings — a critical requirement for any investigation that will be published, reported, or presented in a legal proceeding. And it protects the investigator against claims that evidence was fabricated, selectively assembled, or taken out of context. Findings that cannot be reproduced and verified are not findings. They are allegations. The documentation is what makes the difference.