← TOMPEARL.COM

DIGITAL EVIDENCE // OPEN-SOURCE INTELLIGENCE

Observe everything.
Claim little.
Prove the rest.

A complete path from curious beginner to ethical investigator: scientific method, chain of custody, OSINT, DFIR, Maltego, open-source tools, and the suites used in professional laboratories.

Start the roadmap Explore the toolkit
  • 2separate disciplines
  • 1defensible method
  • 0unauthorized access
CASE // 2026-DFIR-001
HYPOTHESISto test
DISKSHA-256
SOURCE WEBtimestamped
METADATAcorroborated
WITNESSindependent source
CONFIDENCE // HIGH

00 // BEFORE THE FIRST TOOL

A professional is not someone with a lot of browser tabs.

A professional can explain what they were authorized to do, what they collected, what changed, how they know, what could be wrong, and whether another examiner can reproduce the result.

Authorization comes before collection. Work on your own devices, training datasets, genuinely public information, or under written consent or legal authority. “Accessible” does not mean “free to reuse” or “lawful to scrape.” Identify the applicable jurisdiction and document purpose, legal basis, minimization, retention, security, and data-subject rights before collecting.
01

Written scope

Question, authorized subject or assets, permitted sources, time window, excluded data, stop date, and approving authority.

02

Integrity

Preserve the original, work from a copy, calculate cryptographic hashes, and record tools, versions, timestamps, and errors.

03

Corroboration

Automated output is a lead. Confirm important facts with an independent source, another parser, or the native data.

04

Proportionality

Collect only what is necessary. Relatives, coworkers, bystanders, and namesakes are not acceptable collateral damage.

05

Challenge your theory

Actively seek evidence that would disprove your hypothesis. Keep observations, inferences, and unknowns separate in the report.

06

Protection

Encrypt case files, restrict access, set a retention period, and dispose of data properly when the case closes.

Green zone

  • Your own device, account, or domain
  • A warrant, contract, or explicit consent
  • CFReDS, Digital Corpora, CTFs, and lab machines
  • Proportionate verification of a public-interest fact

Amber zone

  • Identifiable people or sensitive data
  • Face recognition and breach data
  • Bulk collection, scraping, or extended retention
  • A vulnerable source, a minor, or physical risk

Pause: consult legal counsel, a privacy officer, an editor, or the engagement lead.

Red zone

  • Accessing an account or system without permission
  • Pretexting, phishing, covert tracking, or harassment
  • Buying or publishing credentials, session cookies, or stolen files
  • Bypassing authentication or doxxing

Method references: NIST SP 800-86, SWGDE — forensic acquisition, Berkeley Protocol, CNIL — OSINT and privacy and French Criminal Code, Art. 323-1. This guide is educational, not legal advice.

01 // ZERO-TO-OPERATOR BOOTCAMP

Your first 90 days, with proof of progress every week.

This sprint builds safe, independent habits before specialization. Budget 8–10 focused hours per week: 2 hours of theory, 5 hours of lab work, 1 hour of notes, and 1–2 hours of review. Paid software is optional; every required exercise has a free path.

START HERE

Minimum setup

  • A host with 16 GB RAM minimum, 500 GB of free storage, and virtualization support
  • One Windows evaluation VM and one SIFT or Ubuntu VM, both snapshot-capable
  • An encrypted case vault, a clean evidence drive, and an offline backup
  • FTK Imager, Autopsy/TSK, KAPE, Zimmerman tools, Volatility 3, Wireshark, ExifTool, and Maltego CE

OPERATING RHYTHM

Every lab follows one loop

  1. Write the question and authority.
  2. Predict what evidence should exist.
  3. Acquire or open only the training data.
  4. Keep contemporaneous notes in UTC.
  5. Validate one key result independently.
  6. Write a one-page finding with limitations.

DO NOT SKIP

Professional habits from day one

  • Never analyze the only copy.
  • Record tool name, version, settings, and errors.
  • Separate observed facts from interpretation.
  • Redact real identifiers from public work.
  • Stop when scope, authority, or safety becomes unclear.
WEEK 01

Systems and evidence language

Learn filesystems, processes, logs, hexadecimal, UTC, hashing, artifacts, provenance, and chain of custody.

OUTPUT

Explain twelve core terms in your own words and hash five files with two tools.

WEEK 02

Build the isolated lab

Create, patch, snapshot, and document Windows and Linux VMs. Separate personal, evidence, OSINT, and malware contexts.

OUTPUT

Network diagram, asset list, clean snapshot hashes, and recovery test.

WEEK 03

Forensic acquisition

Practice evidence intake, imaging, write blocking, verification, working copies, and acquisition logs on a lab USB drive.

OUTPUT

E01 plus raw image, matching SHA-256 values, chain of custody, and error log.

WEEK 04

Windows artifacts

Study MFT, USN Journal, Registry, EVTX, Prefetch, LNK, Jump Lists, Amcache, SRUM, and Recycle Bin semantics.

OUTPUT

Ten reconstructed actions, each tied to a native artifact and parser output.

WEEK 05

Timelines and browser evidence

Normalize time zones, clock offsets, file timestamps, browser history, downloads, cache, and SQLite records.

OUTPUT

A twenty-event timeline with confidence, conflicts, and three independently validated events.

WEEK 06

Memory and network

Identify processes, sockets, persistence clues, DNS, HTTP, TLS metadata, PCAP limitations, and live-collection side effects.

OUTPUT

Correlate one synthetic RAM image and PCAP into a defensible incident narrative.

WEEK 07

OSINT search and preservation

Turn an intelligence requirement into a source plan. Use advanced search, archives, WARC, screenshots, hashes, and source logs.

OUTPUT

A preserved source package and a claim-to-source matrix with no circular corroboration.

WEEK 08

Identity and infrastructure

Practice entity resolution across usernames, registries, RDAP, DNS, certificates, and public code while accounting for namesakes.

OUTPUT

A fictional identity map with two rejected matches and explicit stopping criteria.

WEEK 09

Images, video, and geolocation

Extract metadata and keyframes, perform reverse search, compare terrain and shadows, and distinguish a clue from proof.

OUTPUT

Location and time-window assessment with alternatives, uncertainty, and preserved media.

WEEK 10

Maltego and link analysis

Model entities, run narrow Transforms, label edge provenance, avoid false merges, and reduce a graph for an audience.

OUTPUT

A readable fictional fraud graph plus a source register and five explained relationships.

WEEK 11

Mobile, cloud, and self-defense

Parse supplied Android/iOS and cloud exports, inspect SQLite manually, state collection gaps, then audit your own public exposure.

OUTPUT

A focused mobile finding and a completed anti-OSINT remediation plan.

WEEK 12

Capstone case

Combine disk, memory, network, web, and graph evidence. Answer one precise question without exceeding scope.

OUTPUT

Case brief, notes, exhibits, timeline, report, executive summary, and reproducibility package.

DAYS 85–90

Hostile review and rework

Have a peer challenge authority, collection, timestamps, attribution, alternative hypotheses, and every high-confidence statement.

PASS CONDITION

The peer reproduces five key findings from your package. Correct the failures, version the report, and record what changed.

90-DAY EXIT CHECK

You are ready for the 12-month path when all six are true.

Your progress is saved only in this browser.

0/6 exit conditions completed.

02 // 12-MONTH PROGRESSION

Build reliable habits, then build depth.

Durations assume 7–10 focused hours each week. Do not advance because you watched a course. Advance when you can produce the stated evidence of competence without following a walkthrough.

  1. 0–4weeks

    LEVEL 00 // SHARED FOUNDATION

    Systems, networks, and investigative thinking

    Learn Linux and Windows, NTFS/ext4/APFS, processes, the Windows Registry, event logs, TCP/IP, DNS, HTTP, SQL/SQLite, JSON, regular expressions, Python/PowerShell/Bash, UTC, and time-zone handling.

    HexadecimalHashFilesystemLogsSQLiteRegex
    MASTERY GATE Build one Windows VM and one Linux VM, generate ten documented user actions, then reconstruct the timeline from artifacts without consulting your action list.
  2. 1–2months

    LEVEL 01 // EVIDENCE

    Acquisition, preservation, and documentation

    Study legal authority, scene photography, order of volatility, write blockers, bitstream imaging versus targeted collection, SHA-256, chain of custody, working copies, clock drift, and contemporaneous notes.

    FTK ImagerGuymagerAutopsyExifTool
    MASTERY GATE Image a lab USB drive, verify its hash with two tools, and deliver an intake form, acquisition log, chain-of-custody record, and one-page report.
  3. 2–4months

    LEVEL 02A // DFIR

    Windows artifacts and disk analysis

    Master the MFT and USN Journal, Registry, Event Logs, Prefetch, LNK files, Jump Lists, Amcache, Shimcache, SRUM, Recycle Bin, browser artifacts, and deleted files. Build a super-timeline and explain what each timestamp actually means.

    Autopsy/TSKKAPEZimmerman toolsPlasoTimesketch
    MASTERY GATE Solve a CFReDS or Digital Corpora scenario, then validate three important findings with a second parser or the native structure.
  4. 2–4months

    LEVEL 02B // OSINT

    Research, archiving, and verification

    Define an intelligence requirement and collection plan. Learn search operators, archives, username and domain research, mapping, image and video verification, company registers, and source evaluation. Preserve the URL, UTC time, context, original file, and provenance.

    Bellingcat ToolkitWaybackInVIDHunchlyMaltego
    MASTERY GATE Verify the likely location, time window, and origin of a public training image or video. Document rejected alternatives, limitations, and your confidence level.
  5. 4–7months

    LEVEL 03 // CORRELATION

    Memory, network, mobile, and graphs

    Analyze RAM and processes, PCAPs, network logs, lawfully acquired Android/iOS artifacts, SQLite databases, cloud audit logs, entities, and relationships. Learn the blind spots of every collection method.

    Volatility 3Wireshark/ZeekALEAPP/iLEAPPMaltego/Gephi
    MASTERY GATE Merge disk, memory, and network evidence into one normalized timeline. Mark clock offsets, conflicts, unsupported claims, and collection gaps.
  6. 7–10months

    LEVEL 04 // EXAMINER

    Complete cases, quality control, and testimony

    Develop an examination strategy, validate tools, keep reproducible notes, conduct peer review, write technical and executive reports, disclose limitations, and defend your work under questioning.

    SOPQAReportingPeer reviewTestimony
    MASTERY GATE Give a complete case package to a peer. They must reproduce your five key findings without asking you for missing steps.
  7. 10–12+months

    LEVEL 05 // SPECIALIST

    Choose depth, not ten shallow specialties.

    Specialize in Windows incident response, macOS/iOS, mobile, malware and memory, cloud, fraud, crypto-assets, geolocation, media verification, threat intelligence, or public-interest investigations.

    SpecializationResearchMentoringTool contribution
    MASTERY GATE Publish a tool, parser, synthetic dataset, tested procedure, or reproducible study without exposing real case data.

03 // THE TWO INVESTIGATION LOOPS

Memorize the process, not the buttons.

DFIR

Digital evidence lifecycle

  1. Authorize & prepare

    Define the question, authority or consent, scope, safety risks, equipment, roles, and reference clock.

  2. Identify & prioritize

    Identify potential sources and order of volatility. Collect network state and RAM before shutdown only when the scenario, authority, and procedure support live collection.

  3. Preserve

    Isolate without destroying data, photograph the scene, label and seal each item, and open a chain-of-custody record.

  4. Acquire

    Choose physical, logical, targeted, or live acquisition. Record tool and version, settings, operator, start/end time, errors, and SHA-256.

  5. Examine

    Index and parse a verified working copy. Do not let a suite decide by itself what is relevant or accurate.

  6. Analyze & challenge

    Build timelines and competing hypotheses. Account for artifact semantics, time zones, clock drift, missing telemetry, and anti-forensics.

  7. Validate

    Use a second tool, hex or SQLite view, native source, vendor documentation, test image, or controlled lab reproduction.

  8. Report & archive

    Separate observations, inferences, and limitations. Cite exhibits, complete peer review, control access, and follow retention and authorized disposal rules.

OSINT

Open-source intelligence cycle

  1. Direct

    Write a precise intelligence requirement, intended decision, success threshold, exclusions, and deadline.

  2. Assess risk

    Assess potential harm to subjects, analysts, and third parties; sensitive data; research identities; source exposure; and no-contact rules.

  3. Plan sources

    Start with the least intrusive and most authoritative sources. Record dependencies so mirrored claims are not mistaken for independent confirmation.

  4. Collect & preserve

    Capture URL, UTC timestamp, page context, WARC when appropriate, original media, metadata, and cryptographic hash.

  5. Evaluate

    Source reliability is not the same as information credibility. Detect circular reporting, satire, outdated pages, manipulated context, and synthetic content.

  6. Analyze

    Resolve entities, map relationships, normalize time and geography, compare hypotheses, and identify missing information.

  7. Corroborate

    Seek genuinely independent sources and trace claims to the earliest available original instead of counting republications.

  8. Disseminate & close

    Deliver a proportionate answer with explicit confidence, minimized third-party data, handling markings, retention, and documented purge.

ANALYTIC LANGUAGE

Write only what you actually know.

Observed fact
“The log contains event X at 14:03 UTC.”
Inference
“This is consistent with a login, but does not by itself identify the person at the keyboard.”
Confidence
Low / moderate / high, with the rationale and the information that could change the assessment.
Unknown
The absence of an artifact is not automatically proof that an action did not occur.

04 // FIELD-READY PROCEDURES

Repeatable checklists beat perfect memory.

Adapt these templates to your organization, jurisdiction, and validated tools. They are training baselines—not substitutes for legal authority, laboratory policy, or device-specific guidance.

SOP 01

Disk or removable-media acquisition

  1. Confirm case ID, authority, scope, requested output, and who may receive it.
  2. Prepare tested write-blocking hardware, sanitized destination media, labels, camera, forms, and a trusted clock.
  3. Photograph condition, connections, serial numbers, date/time display, packaging, and powered state before handling.
  4. Record the live-versus-dead acquisition decision. Do not improvise on a powered device when volatile data may matter.
  5. Connect through the tested write blocker and record its model, serial number, firmware, and validation date.
  6. Create the required E01 or raw image. Record tool/version, settings, start/end UTC, source and destination identifiers, capacity, and all errors.
  7. Generate SHA-256 during acquisition and verify it independently after acquisition. Explain any mismatch before continuing.
  8. Seal or secure the original and master image; analyze only a verified working copy. Complete custody transfer and storage records.
SOP 02

Web and social-media preservation

  1. Write the intelligence requirement, legal basis, collection window, no-contact rule, and third-party minimization plan.
  2. Record the full URL, access time in UTC, collector identity, account/login context, browser profile, and visible page state.
  3. Capture context as well as the claim: profile or publisher, surrounding thread, date, comments where relevant, and navigation path.
  4. Create a full-page capture and, when appropriate, a replayable WARC. Note dynamic elements, deleted content, login walls, and capture failures.
  5. Download the original public file only through permitted features. Preserve it unchanged; examine metadata and derivatives on copies.
  6. Hash every collected file, export the capture log, and name exhibits consistently with the case register.
  7. Trace reposts to the earliest available source and record whether supposed confirmations depend on the same origin.
  8. Minimize unrelated personal data, document retention, and preserve the source package separately from the analytical report.
SOP 03

Live memory and network collection

  1. Document why volatile evidence is necessary and why collection risk is proportionate.
  2. Record hostname, logged-in users, displayed time, clock offset, network state, and tool source before execution.
  3. Use a validated collector from controlled media and record its hash, version, command or settings, privilege level, and expected footprint.
  4. Capture memory and relevant network state in the approved order; never conceal that the action changed the running system.
  5. Save tool output and stderr, calculate hashes, and record partial reads, crashes, endpoint controls, or lost packets.
  6. Correlate volatile output with disk, EDR, firewall, DNS, authentication, and cloud logs where available.
  7. Distinguish a process, connection, account, device, and human actor; they are not interchangeable identities.
  8. Retain the untouched capture and analyze a copy inside an isolated environment.
SOP 04

Validate a tool before trusting it

  1. Define the exact function under test and the versions of tool, parser, operating system, and dependencies.
  2. Use a known-answer dataset or generate a controlled action set whose ground truth is recorded separately.
  3. Test expected positives, expected negatives, malformed input, unsupported versions, time zones, and boundary values.
  4. Compare critical output with the native structure, an independent parser, vendor documentation, or a manual calculation.
  5. Record false positives, false negatives, transformations, truncation, rounding, and fields the tool does not expose.
  6. Repeat after meaningful updates and preserve the dataset, result hashes, logs, screenshots, and reviewer approval.
  7. State the validated scope narrowly; success on one artifact version does not validate every function.
  8. If a result cannot be validated, label it as a lead and lower confidence instead of hiding the limitation.

COPY THIS FORMAT

One action, one contemporaneous note

CASE / EXHIBIT / DATE-TIME UTC / OPERATOR / AUTHORITY / SOURCE / ACTION / TOOL + VERSION / SETTINGS / INPUT HASH / OUTPUT HASH / RESULT / ERROR OR DEVIATION / NEXT STEP

Write notes while working. Never silently rewrite history: append corrections with author, time, reason, and the previous value preserved.

Claim-to-evidence matrix

IDClaimDirect evidenceCorroborationAlternativeConfidenceLimitation
F-01Precise statement that answers part of the case questionExhibit and artifact, with locationIndependent source or native validationStrongest competing explanationLow / moderate / high with rationaleMissing data, parser scope, clock, attribution, or collection gap

MASTERY RUBRIC

“Professional” describes reproducibility and judgment—not the number of tools installed.

DomainBeginnerJuniorPractitionerProfessional
PreservationCan hash a file.Images training media from a checklist.Chooses and justifies a collection method.Handles exceptions, validates the process, and survives custody review.
Artifact analysisReads parser output.Explains common artifacts.Correlates artifacts and validates critical fields.Recognizes version-dependent semantics, parser failure, and anti-forensics.
OSINTFinds public pages.Archives sources and records provenance.Resolves entities and tests alternatives.Runs proportionate collection, protects people, and detects dependency between sources.
ReportingLists observations.Links findings to exhibits.Separates facts, inference, confidence, and limitations.Produces concise work that a peer can reproduce and a nontechnical decision-maker can understand.
JudgmentFollows steps.Recognizes obvious uncertainty.Knows when to stop, escalate, or lower confidence.Defends decisions, corrects errors transparently, and improves the SOP.
Essential glossary: 14 terms you must be able to explain
Artifact
A data structure produced by a system or application that may reflect an event or state.
Acquisition
A controlled process for collecting data while documenting changes and integrity.
Physical / logical
Physical targets storage-level data; logical targets data exposed through a filesystem, API, backup, or application.
Hash
A cryptographic digest used to detect change, not to prove who created the data.
Chain of custody
The chronological record of who possessed, transferred, stored, or accessed an item.
Provenance
Where information came from and how it was collected, transformed, and preserved.
Parser
Software that interprets a data structure; its output can be incomplete or wrong.
Timeline
Normalized events ordered in time, with artifact semantics and clock limitations retained.
Entity resolution
Determining whether records refer to the same real-world entity without merging on weak similarities.
Corroboration
Support from a genuinely independent source or method, not another copy of the same claim.
Confidence
A reasoned expression of uncertainty, tied to evidence quality and alternatives.
Write blocker
A tested control intended to prevent writes to source media during acquisition.
Working copy
A verified copy used for examination so the preserved source or master remains unchanged.
Scope
The authorized subjects, systems, sources, actions, dates, and exclusions of the examination.

05 // YOUR LABORATORY

Four environments, four distinct purposes.

Do not mix personal activity, web collection, malware analysis, and evidence processing. Professional Windows suites and open-source Linux workflows complement each other.

PRIMARY DFIR WORKSTATION

Windows 11 Pro

Best compatibility with AXIOM, EnCase, FTK, X-Ways, Cellebrite, MSAB, Oxygen, Belkasoft, and Zimmerman tools.

  • 32–64 GB RAM, fast NVMe scratch disk, and separate evidence storage
  • BitLocker for the workstation; evidence-volume encryption per laboratory policy
  • Standard user account, controlled updates, and a network that can be isolated

OPEN-SOURCE ANALYSIS

SANS SIFT / Ubuntu

File-system, timeline, memory, network, and scripting workflows in a free, reproducible, well-documented DFIR distribution.

  • Snapshot-capable VM or dedicated workstation
  • Autopsy/TSK, Plaso, libewf, Volatility, and command-line tools
  • Alternatives: CAINE, Tsurugi, and PALADIN

MALWARE

REMnux + FLARE-VM

Use two disposable, isolated VMs: Linux for artifacts and network behavior, Windows for reverse engineering. Never bridge them to evidence storage or the production LAN.

  • Known-clean snapshots and simulated network services
  • No clipboard or shared folders unless explicitly required
  • Handle samples only with authorization, containment, and a recovery plan

OSINT RESEARCH

Dedicated profile or VM

A separate browser profile and encrypted case vault are often enough. Qubes/Whonix or Tails address specific threat models; they are not costumes or automatic anonymity.

  • Approved research accounts; no deceptive personal relationships
  • Open downloads inside a disposable sandbox
  • A VPN moves trust; it does not guarantee anonymity

Minimum laboratory architecture

ORIGINAL
read-only→MASTER
hash + sealed→COPY
working→ANALYSIS
isolated→REPORT
cited exhibits
  • Synchronize time and record the reference time zone.
  • Retain tool versions, licenses, logs, meaningful screenshots, and raw outputs.
  • Test the write blocker and acquisition procedure before a real case.
  • Never connect an original item “just to take a look.”
  • A cloud or mobile extraction is not necessarily a bitstream image. State exactly what was collected and what was unavailable.

06 // PUBLICLY DOCUMENTED TOOL ECOSYSTEM

Tools worth knowing — and where they actually fit.

No static list can contain “every tool used by police.” Tooling varies by country, agency, unit, budget, case type, and procedure; some capabilities are export-controlled or restricted to eligible organizations. This catalog covers the major publicly documented ecosystems. Knowing a product name grants neither a license, legal authority, nor examiner competence.

01
Acquisition, disk, and general forensic suitesPreserve, image, examine, validate

FTK Imager

Free forensic preview and acquisition; useful for Windows disk images and memory captures.

Exterro ↗FREE

Guymager

Fast Linux imager for raw, EWF/E01, and AFF formats, with integrity verification.

Official site ↗OPEN SOURCE

dc3dd · dcfldd · libewf

Command-line acquisition and image handling. Powerful tools that require tested procedures and validation.

libewf ↗OPEN SOURCE

Autopsy + The Sleuth Kit

Open-source platform for disk, file, timeline, keyword, and module-based analysis.

Autopsy ↗OPEN SOURCE

Magnet AXIOM

Multi-source recovery, analysis, and reporting across computers, mobile devices, cloud data, and vehicles.

Magnet ↗PRO

OpenText Forensic / EnCase

Long-established suite for collection, triage, examination, and reporting in laboratories and enterprises.

OpenText ↗PRO

Exterro FTK

Indexing, processing, and review of large data volumes, with laboratory and enterprise editions.

Exterro ↗PRO

X-Ways Forensics

Portable, fast, granular environment derived from WinHex and valued for low-level analysis.

X-Ways ↗PRO

Belkasoft X Forensic

Computer, RAM, mobile, cloud, vehicle, and drone suite. Its Forensic edition is marketed to government customers.

Belkasoft ↗RESTRICTED

Tableau · Logicube · Atola

Hardware write blockers and imagers (TX1, Falcon-NEO, TaskForce) for controlled acquisition at scale.

Tableau ↗HARDWARE
02
Triage, Windows artifacts, and timelinesFrom raw signals to user activity

KAPE

Targeted collection and processing through targets and modules; ideal for reproducible triage.

Kroll ↗FREE

Eric Zimmerman Tools

Registry Explorer, EvtxECmd, MFTECmd, RECmd, LECmd, JLECmd, PECmd, AmcacheParser, and other Windows parsers.

Official index ↗FREE

RegRipper

Plugin-based extraction of artifacts from Windows Registry hives.

GitHub ↗OPEN SOURCE

Hayabusa · Chainsaw · Zircolite

Fast hunting across EVTX files and logs with Sigma rules; alerts must be interpreted in context.

Hayabusa ↗OPEN SOURCE

Plaso / log2timeline

Aggregates many timestamped sources into a super-timeline.

Documentation ↗OPEN SOURCE

Timesketch

Collaborative timeline analysis with search, views, tags, and notebooks.

Official site ↗OPEN SOURCE

Hindsight

Chromium data parser for history, downloads, cookies, caches, and extensions.

GitHub ↗OPEN SOURCE

F-Response

Read-only remote access to disks, RAM, and cloud data for existing forensic tools.

F-Response ↗PRO
03
Memory, endpoint, network, and malwareLive systems, volatile data, and executables

Volatility 3

Open-source memory-forensics framework for Windows, Linux, and macOS.

Documentation ↗OPEN SOURCE

MemProcFS

Exposes memory as a virtual file system and provides APIs, plugins, and live or offline analysis.

GitHub ↗OPEN SOURCE

WinPmem · AVML · LiME

RAM acquisition for Windows, cloud Linux, and Linux kernels. Every live capture changes the system, so document its footprint.

WinPmem ↗OPEN SOURCE

Velociraptor

Endpoint collection, hunting, and response at scale using VQL and auditable artifacts.

Documentation ↗OPEN SOURCE

GRR · osquery · UAC

Remote response, state querying, and Unix collection; integrate them into authorization and retention procedures.

GRR ↗OPEN SOURCE

Wireshark · TShark · tcpdump

Packet capture and protocol inspection. Preserve the original PCAP and filter a working copy.

Wireshark ↗OPEN SOURCE

Zeek · Arkime · NetworkMiner · Zui

Network metadata, sessions, extraction, and exploration of large PCAPs; Suricata adds signature-based detection.

Zeek ↗OPEN SOURCE

REMnux · FLARE-VM

Linux and Windows malware-analysis environments designed for isolated, resettable labs.

REMnux ↗OPEN SOURCE

Ghidra · IDA · Binary Ninja · x64dbg

Disassembly, decompilation, and debugging. Editions and licenses differ; start with Ghidra.

Ghidra ↗MIXED

YARA · capa · FLOSS · CyberChef

Classification, capability identification, obfuscated strings, and data transformations. Always verify the output.

capa ↗OPEN SOURCE
04
Mobile, cloud, vehicle, and IoTProfessional ecosystems and open parsers

Cellebrite Inseyets / UFED

Mobile acquisition and analysis through Physical Analyzer; Pathfinder correlates large datasets. Access, capabilities, and lawful use are controlled.

Cellebrite ↗RESTRICTED

Magnet Graykey / Verakey

Advanced mobile access for eligible customers, plus consent-based or enterprise extraction depending on the product. Not a consumer tool.

Magnet ↗RESTRICTED

MSAB XRY + XAMN

XRY extracts; XAMN searches, visualizes, analyzes, and reports. Some capabilities are dual-use and export controlled.

MSAB ↗RESTRICTED

Oxygen Forensic Detective

Acquisition and analysis of mobile devices, cloud data, backups, drones, and applications with relationship views.

Oxygen ↗PRO

Elcomsoft iOS Forensic Toolkit

iOS acquisition and analysis; Phone Breaker and Distributed Password Recovery cover backups, cloud sources, and authorized recovery.

Elcomsoft ↗PRO

MOBILedit Forensic

Logical or physical acquisition where supported, app decoding, review, and mobile reporting.

MOBILedit ↗PRO

ALEAPP · iLEAPP · MVT

Open Android and iOS artifact parsers, plus Mobile Verification Toolkit for identifying traces of compromise.

ALEAPP ↗OPEN SOURCE

mac_apt · APOLLO

macOS artifact analysis and a collection of SQLite queries and indicators for Apple devices.

mac_apt ↗OPEN SOURCE

Purview · Google Vault · CloudTrail

Native eDiscovery and audit sources. Preserve exports, manifests, time range, collector identity, and API limitations.

Microsoft ↗CLOUD

Berla iVe · XRY Drone

Acquisition and analysis of infotainment systems and drone data. A specialist domain where vendor support and validation are critical.

Berla ↗PRO
05
Image, video, documents, and online evidenceAuthenticity, enhancement, provenance, and preservation

Amped FIVE + Authenticate

Conversion, enhancement, and scientific image or video analysis with an operation history.

Amped ↗PRO

iNPUT-ACE · Cognitech · Griffeye

Proprietary CCTV video, enhancement, and large-scale media review, depending on specialty.

iNPUT-ACE ↗PRO

ExifTool · FFmpeg · MediaInfo

Metadata, controlled transcoding, and stream inspection. Always preserve the original media.

ExifTool ↗OPEN SOURCE

InVID-WeVerify · C2PA Verify

Keyframes, reverse-image search, metadata, and verification of signed provenance information.

InVID ↗FREE

ArchiveWeb.page · Webrecorder

Replayable WARC capture of dynamic web content. Complements screenshots and contemporaneous notes.

ArchiveWeb.page ↗OPEN SOURCE

Hunchly · Page Vault · WebPreserver

Web collection with logging, traceability, and investigation- or litigation-oriented exports.

Hunchly ↗PRO

oletools · PDFiD · pdf-parser

Triage of suspicious Office and PDF documents; analyze only in an isolated environment.

oletools ↗OPEN SOURCE

Nuix · Relativity · Axon Evidence

Large-scale processing, review, exhibit management, and collaboration. Guardian and Magnet Review/Automate also occupy this layer.

Nuix ↗INSTITUTION
06
Search, archives, identities, and exposureGeneral OSINT and high-risk breach services
Leaked data is not an open buffet. Use services marked “sensitive” only to check your own identifiers, your organization’s assets, or a subject covered by documented authority. Do not download passwords, session cookies, infostealer files, or intimate data. Verify provenance, legality, and accuracy, and redact unrelated third parties from the report.

Google · Bing · Brave · Yandex

Use complementary engines, operators, caches, and local languages. Preserve the source page; a search snippet is not evidence.

Advanced search ↗PUBLIC

Wayback · Common Crawl · Perma.cc

Historical versions and web corpora. Archive.today can complement them; record who archived what, when, and what is missing.

Wayback ↗PUBLIC

Bellingcat Toolkit · OSINT Framework

Category-based resource directories. They are maps, not guarantees of reliability.

Bellingcat ↗INDEX

WhatsMyName · Sherlock · Maigret · Blackbird

Username discovery. A shared handle does not prove a shared identity; compare content, dates, and context.

WhatsMyName ↗MIXED

Have I Been Pwned

Exposure checks and alerts without revealing plaintext passwords. The first choice for self-auditing.

HIBP ↗DEFENSIVE

IntelBase

Email enrichment, accounts, timelines, breaches, and infostealer logs. Use only with authority and strict minimization.

IntelBase ↗SENSITIVE

OSINTLeak

Search and monitoring for exposed identities and infrastructure. Some plans advertise unredacted passwords: do not access them without an explicit legal basis.

OSINTLeak ↗SENSITIVE

OathNet

Unified search platform for breaches, identities, and activity. This is likely the service meant by “oatnhet.com”; the verified domain is oathnet.org.

OathNet ↗SENSITIVE

Intelligence X · DeHashed · Leak-Lookup

Exposure and archive search engines. Treat results as sensitive leads that may be incomplete or misattributed.

Intelligence X ↗SENSITIVE

Skopenow · ShadowDragon · Babel Street

Institutional platforms for investigations, identity, social networks, and risk. Some functions are restricted and highly intrusive.

SocialNet ↗INSTITUTION
07
Infrastructure, threats, and the webDomains, certificates, exposed services, and pivots

ICANN Lookup · RDAP · DNS

Registration, delegation, resolvers, and MX/TXT/NS records. Privacy-protected WHOIS is not suspicious by default.

ICANN ↗PUBLIC

crt.sh · Certificate Transparency

Public certificate history and hostname discovery; account for third-party and retired assets.

crt.sh ↗PUBLIC

Shodan · Censys · Netlas

Indexes of exposed services and certificates. Viewing an index never authorizes connecting to or testing a target.

Censys ↗MIXED

DomainTools · SecurityTrails · DNSDumpster

Historical WHOIS and DNS, pivots, and mapping. Distinguish co-hosting, control, and simple correlation.

SecurityTrails ↗MIXED

VirusTotal · urlscan.io · OTX

Reputation, relationships, rendered pages, and indicators. Never submit a confidential file or URL to a public service.

VirusTotal ↗MIXED

PublicWWW · BuiltWith · Wappalyzer

Search public web code and technologies. GitHub and code search can reveal already exposed secrets that should be reported responsibly.

PublicWWW ↗MIXED

SpiderFoot · Recon-ng · theHarvester

Automated collection and correlation. Restrict modules to scope and verify false positives.

SpiderFoot ↗OPEN SOURCE

Recorded Future · Flashpoint · DarkOwl

Threat intelligence, underground forums, and risk monitoring for authorized teams. Searchlight Cyber and Intel 471 serve the same segment.

Recorded Future ↗ENTERPRISE

MISP · OpenCTI

Structured, controlled sharing of indicators and CTI knowledge; taxonomies, markings, and dissemination matter as much as ingestion.

OpenCTI ↗OPEN SOURCE
08
Geolocation, media, transport, and field researchVerify without turning a lead into certainty

Google Earth · OSM · Mapillary

Terrain, buildings, roads, and street-level imagery. Bing Maps and KartaView provide different dates and coverage.

Google Earth ↗PUBLIC

Copernicus Browser · NASA Worldview

Multi-date satellite imagery and environmental layers. Document resolution, date, cloud cover, and processing.

Copernicus ↗PUBLIC

SunCalc · PeakVisor · GeoHints

Sun and shadow geometry, terrain, and geographic clues. Use them to test a hypothesis, never as isolated proof.

SunCalc ↗PUBLIC

Google Lens · TinEye · Yandex Images

Reverse-image search and earliest-known appearance. Compare crops, mirrors, dates, and the original page.

TinEye ↗PUBLIC

Forensically · FotoForensics

Visual aids for compression and pixel analysis. They cannot determine by themselves whether an image is “real” or “fake.”

Forensically ↗FREE

PimEyes · FaceCheck · Clearview AI

Facial search and recognition carry high risks of false positives and rights violations. Clearview is institutional; every match requires human review and a lawful basis.

Clearview AI ↗HIGH RISK

ADS-B Exchange · FlightRadar24 · MarineTraffic

Aircraft and vessel positions or histories where coverage exists. Gaps, delays, and filtering are common.

ADS-B Exchange ↗MIXED

BriefCam · Genetec

Institutional video analysis and management. Analytics can prioritize review but never replace the examiner.

BriefCam ↗INSTITUTION
09
Companies, finance, sanctions, crypto, and graphsMove from a name to a verifiable structure

OpenCorporates · Official registers

Officers, entities, and filings. Prefer the national registry, SEC EDGAR, Companies House, INPI/Data INPI, or Pappers as an interface.

OpenCorporates ↗PUBLIC

OpenSanctions · OCCRP Aleph · ICIJ

Sanctions, politically exposed persons, archives, and offshore structures. Verify identity before drawing conclusions.

OpenSanctions ↗MIXED

TED · BOAMP · BODACC · data.gouv.fr

Public procurement, corporate filings, and open data. Reuse terms and data-protection law still apply.

TED ↗PUBLIC

Etherscan · Blockchair · GraphSense

Transaction explorers and graphs. An address is not an identity without corroborated attribution.

GraphSense ↗MIXED

Chainalysis · TRM · Elliptic

Institutional blockchain investigation, attribution, and risk scoring. Heuristics must be explainable and open to challenge.

Chainalysis ↗PRO

Maltego · Gephi

Collection, pivots, and graph visualization. A graph edge shows a data relationship, not necessarily a human relationship.

Maltego ↗MIXED

IBM i2 · Palantir Gotham · PenLink

Link analysis, data fusion, and institutional intelligence. Access and datasets depend on the organization.

IBM i2 ↗INSTITUTION

Accurint · Thomson Reuters CLEAR

Public-record and identity aggregation for authorized organizations, particularly in the United States.

Accurint ↗INSTITUTION
The two-tool rule. For a critical finding, compare two independent parsers where possible, or compare the output with native data. A polished interface can present a wrong interpretation with great confidence.

07 // MALTEGO WITHOUT THE MYTH

A graph is a notebook of hypotheses, not a truth machine.

Maltego becomes powerful when context stays visible: entity, provenance, date, confidence, and the reason for each edge. Transforms accelerate pivots; they do not prove that two nodes represent the same person.

  1. 01
    Create the case brief

    Record the question, scope, authorized identifiers, date, and stopping criteria.

  2. 02
    Add known seeds

    Create one entity per fact and attach a source, timestamp, and note immediately.

  3. 03
    Run a small number of Transforms

    Choose the pivot that answers the question. Avoid “run all” and uncontrolled collection.

  4. 04
    Classify every relationship

    Mark it observed, declared, calculated, or assumed, with confidence and an expiry date.

  5. 05
    Merge only after validation

    A shared name, avatar, IP address, or postal address is not enough.

  6. 06
    Export an intelligible product

    Provide a reduced graph, timeline, sources, limitations, and answer—not a spaghetti wall.

Maltego exercise: map only fictional entities from a fraud scenario. Ask a peer to insert two namesakes and one CDN IP address. Your objective is to avoid merging them.

08 // PRACTICE WITHOUT VICTIMS

Your portfolio must demonstrate your method.

CASE 01

The USB drive

Create E01 and raw acquisitions, hash them, recover files, build a timeline, and compare Autopsy/X-Ways or Autopsy/TSK.

Deliverables:

Fictional authority, chain of custody, notes, report, and limitations.

CASE 02

The compromised workstation

Use synthetic Windows disk, RAM, and PCAP evidence. Reconstruct initial access, execution, persistence, and actions.

Deliverables:

Super-timeline, five exhibits, an alternative hypothesis, and detection rules.

CASE 03

The viral media item

Find the earliest publication, probable location, time window, and file transformations.

Deliverables:

WARC and captures, independent sources, confidence, and error risk.

CASE 04

The fictional company

Use registries, domains, certificates, documents, and a Maltego graph without real personal data.

Deliverables:

Entity resolution, provenance, timeline, and a minimization record.

CASE 05

The provided mobile extraction

Analyze a supplied training extraction; bypass no lock. Compare ALEAPP/iLEAPP with a forensic suite.

Deliverables:

SQLite artifacts, time-zone handling, manual validation, and a focused report.

CASE 06

The hostile review

A peer acts as counsel, privacy officer, or manager and challenges five conclusions.

Deliverables:

Source-backed answers, accepted corrections, and a newly signed version.

Safe datasets and practice platforms

NIST CFReDSDigital CorporaMagnet CTFCyberDefendersBlue Team Labs OnlineTrace Labs

Trace Labs involves missing people: follow its rules strictly, contact nobody, and publish no personal data. In every exercise, use synthetic identities and redact sensitive data from your portfolio.

Minimum professional report

  1. Authority, scope, and question
  2. Sources, exhibits, and chain of custody
  3. Environment, tools, versions, and reference clock
  4. Reproducible method
  5. Numbered findings linked to exhibits
  6. Facts, inferences, and confidence kept separate
  7. Alternative hypotheses and limitations
  8. Conclusion that answers the exact question
  9. Appendices: hashes, logs, timeline, and glossary
  10. Review, signatures, dissemination, and retention

09 // BECOME EMPLOYABLE

Choose the role before the badge.

A certification can structure learning or pass an HR filter. It cannot replace reproducible casework, clear writing, or judgment.

ENTRY

Evidence Technician / Junior DFIR

Acquisition, triage, inventory, data quality, and procedures.

Security+BTL1CFCE later
INVESTIGATE

Forensic Examinerr

Computer, Windows artifact, mobile, or media examination; defensible reports and review.

GCFECFCEEnCEMCFE
RESPOND

Incident Responder / Threat Hunter

Endpoints, memory, network, cloud, containment, and detection.

GCFAGNFAGCIH
MOBILE

Mobile Examinerr

Lawful acquisition, decoding, SQLite validation, and device-specific limitations.

GASFCCMEICMDE
INTELLIGENCE

OSINT / Threat Intelligence Analyst

Collection planning, verification, graphs, briefing, and source protection.

GOSIMaltego AcademyPortfolio
EXPERT

Lead Examiner / Expert Witness

SOPs, validation, QA, testimony, mentoring, budget, and laboratory governance.

ExperienceJurisdictionPeer review

Official learning paths: GIAC DFIR, IACIS, Cellebrite Training and Magnet Certifications. Check prerequisites, current content, cost, and local recognition before paying.

10 // DEFEND AGAINST OSINT

Which operating system? The one that fits your threat model—and that you can maintain.

A poorly managed specialist OS protects less than a mainstream system that is patched, encrypted, and compartmentalized. Anti-OSINT does not erase the past; it reduces new links and limits the blast radius.

ProfileeRecommended systemWhyCritical limitation
Everyday useMaintained Windows 11, macOS, Fedora, or UbuntuUpdates, BitLocker/FileVault/LUKS, separate profiles, and broad compatibilityThe OS cannot fix identity reuse or what you publish.
Hardened mobileCurrent iPhone or GrapheneOS on an officially supported deviceEncryption, sandboxing, and profiles; iPhone Lockdown Mode for targeted threatsThe phone number, contacts, SIM, and accounts remain correlatable.
Sensitive researchQubes OS with separate qubes; Whonix for Tor trafficStrong compartmentalization, disposable VMs, and network/USB isolationRequires compatible hardware and discipline; one personal login can link contexts.
Ephemeral sessionTails sur USBAmnesic by default, traffic over Tor, and metadata toolsNot magic: metadata, behavior, compromised hardware, and correlation remain possible.
1

Identities

  • Use a different alias, avatar, bio, and email in each context
  • Share no recovery email or phone number between personas
  • Never interact between your own identities
  • Avoid unique biographical details and repeated writing signatures
2

Accounts

  • Unique password, password manager, and FIDO2 key
  • A unique email alias per service; keep phone numbers private where possible
  • Hide friend lists, birthday, employer, and location
  • Remove old sessions, connected apps, and unused accounts
3

Content

  • Remove EXIF and document properties before publishing
  • Inspect backgrounds, reflections, badges, license plates, and windows
  • Post after leaving a location and avoid predictable times and routines
  • Do not reuse the same file: hashes and matching crops can create links
4

Infrastructure

  • Use WHOIS privacy and registrar MFA; audit DNS and certificates
  • Use contact details and a mailbox appropriate to the legal context
  • Do not expose a personal IP through careless self-hosting
  • Use separate browser profiles, blockers, and minimum permissions
5

Public data

  • Regularly search your name, usernames, email addresses, phone number, and photos
  • Use HIBP alerts and rotate exposed secrets immediately
  • Submit applicable search delisting and data-broker opt-out requests
  • Review company registries, domains, PDF documents, and family exposure
6

Relationships

  • Tell family and friends about risks from photos, tags, and real-time announcements
  • Use a family verification phrase against impersonation and deepfakes
  • Put no secret in a link preview or public calendar
  • Maintain a doxxing response plan: evidence, reporting, host, employer, and authorities

30-minute quarterly audit

0/6 checks completed on this device.

Read the documentation before installation: Qubes OS, Tails warnings, Whonix/Tor limitations and supported GrapheneOS devices.

11 // AI, AUTOMATION, AND ERROR

AI can sort a mountain of data. It can also invent the missing exhibit.

Acceptable

Translate or summarize authorized material, suggest queries, prioritize human review, generate lab scripts, and propose hypotheses.

Required controls

Preserve the input, model/version/date, parameters, raw output, human validation, and primary source for every finding.

Never acceptable as a conclusion

“The model says it is them,” an unvalidated facial score, AI-image detection treated as a verdict, a nonexistent citation, or attribution without evidence.

CONCLUSION // THE HUMAN WEAKNESS

“Anonymous” is not an identity.
It is a fragile property of one specific action.

A VPN, Tor, Tails, Qubes, or a disposable username makes nobody invisible. A posting time, writing habit, reused avatar, talkative relative, payment, recovery account, or background detail can connect years of compartmentalized activity.

The largest exposure surface is often human: convenience, urgency, repetition, and trust. The realistic objective is not “absolute anonymity.” It is to reduce links, minimize data, separate contexts, verify before acting, and know what to do when separation fails.

The best investigator questions the tool. The best defense questions its habits.
Personal security manual →Cybersecurity roadmap →Back to top ↑

Primary references and continued learning

NIST CFTTSWGDESANS SIFTBellingcat ToolkitEuropol Cyber IntelligenceCNIL OSINT

Capabilities, licenses, URLs, and rules change. Always check official documentation, security advisories, available NIST tests, and the law in your jurisdiction. Last reviewed: August 8, 2026.