Why learn techniques instead of tools?
Because tools break on somebody else's schedule, and this is not a hypothetical worry.
In one day on this deployment: Instagram stopped answering through every path we had, a paid breach API started replying that the subscription had no credits, and three session-based checkers expired at once. Nothing was announced. The tools carried on registering and returning nothing, which is worse than failing loudly.
Meanwhile a search operator typed into a browser worked exactly as it did ten years ago. That is the whole argument for learning the methods rather than a product's menu: the methods are the part you still have on the morning something breaks.
It is also why a tool worth paying for is one that admits what stopped answering. Silence is the failure mode that costs you a wrong conclusion rather than an error message.
How do search operators actually work?
They stop the engine from being helpful, which is what you want when you already know what you are looking for.
"exact phrase" disables synonym matching, so a handle is searched as the string rather than as an idea. site:example.com restricts to one domain, and it is frequently better than that site's own search. filetype:pdf finds documents rather than pages, which is where organisations leak names. -word removes a meaning that keeps dominating.
Combined, these turn an unusable common name into something tractable: the name in quotes, plus a city or an employer you already know, minus the famous person who shares it. This is the highest-yield technique in the field and it is skipped constantly because it looks too simple to matter.
How do you find something that was deleted?
You usually do not need to, because it was copied before it went.
The Wayback Machine holds snapshots of pages going back to 1996, and a profile, a staff page or a company site that has been cleaned up is often intact there with its old contents. It also shows you when something changed, which is frequently more informative than the change itself.
Two habits make it work. Look at the calendar view rather than the latest snapshot, because the interesting version is rarely the last one. And remember that absence proves nothing: the archive only holds what a crawler happened to visit, so a missing page may never have been captured rather than never have existed.
Search engine caches cover the same ground for recent changes, and between the two most deletions from the last decade are still readable somewhere.
The tool is the part that breaks. The method is the part you still have on the morning it does.
What can a timestamp tell you?
More than most profiles admit, because plenty of platforms put the creation date inside the account ID itself.
Several large services generate IDs that encode the millisecond the account was made — Discord and Twitter both use variants of this, and it means an account with a hidden join date still carries its birthday in the number. Extracting it takes arithmetic rather than access.
That matters because dating an identity is usually the actual question. An account created three weeks ago that claims a decade of history has contradicted itself, and no amount of profile content outweighs the number. It is also one of the few facts nobody can edit after the fact.
Where a platform publishes a join date openly, use that instead and save yourself the arithmetic. The technique is for the platforms that stopped.
How do you map a company's infrastructure?
Through certificate transparency, which is a public log nobody can opt out of.
Every TLS certificate issued for a domain is written to public append-only logs, and crt.sh makes them searchable. Searching a domain returns subdomains the organisation never linked anywhere: staging servers, internal tools, forgotten products, acquisitions.
The reason it works is structural rather than accidental. The logs exist so that browsers can detect fraudulent certificates, which means the disclosure is a security feature the whole web depends on. Nobody is going to close it, which is exactly the property that makes a technique worth learning.
For a person rather than a company this is usually a dead end, since individuals rarely hold certificates. It earns its place here because it is the clearest example of the pattern: a disclosure that exists for a reason nobody wants to remove.
How do you tell a failed source from an empty one?
By insisting on being told, and by distrusting anything that will not tell you.
A source that answered and found nothing is evidence. A source that timed out, hit a rate limit or broke that morning is unknown. Those two produce identical blank space in a report that only prints hits, and treating the second as the first is the single commonest way to reach a confident wrong conclusion.
The scale is not marginal. In a run measured in July 2026, of 74 sources against one address, 11 errored and 4 were rate-limited — a fifth of the run. Any tool that showed you the 19 hits and stopped would have hidden that, and the discipline around pivoting depends on knowing the difference.
Which techniques are not worth learning?
Three that appear on every list of this kind and earn their place through tradition rather than results.
- Metadata on downloaded images. Every platform strips it on upload, so unless you have an original file there is nothing to read.
- Elaborate sock puppet accounts. Enormous maintenance, real legal exposure, and the platforms detect them. Almost every question a puppet answers is answerable another way.
- Anything requiring somebody's credentials. That is not a technique, it is unauthorised access, and the line is authorisation rather than difficulty.
The pattern is that these all require holding something — an original file, an account, a credential. The techniques that last require nothing but knowing the question.
That is a reasonable filter for any new technique somebody recommends: ask what it needs you to possess, and how long you get to keep it.
What are you allowed to do with these?
Searching public sources is lawful in the United States and the EU. The restrictions are all on use, and they apply to a hand-typed operator exactly as they apply to a paid platform.
In the United States, using the result to decide employment, housing, credit, insurance or tenancy puts you under the Fair Credit Reporting Act. In the EU and the UK, public personal data is still personal data and processing it needs a lawful basis under the GDPR.
Scraping is the one place where the technique itself can cross a line. A page you may read in a browser is not automatically one you may collect automatically, because terms and rate limits are separate from access.
Running the search yourself changes nothing legally. Where the query executes affects who logs it, not what you may do with the answer. A technique performed by hand carries the same obligations as one bought from a vendor.
How do these map onto a report?
Directly, and knowing them makes any report easier to read — ours or anybody's.
The account-existence lines are the operator technique done at scale, against 71 sources for an address and 71 platforms for a handle. The join dates are the timestamp technique. The breach years are archival evidence of when something existed.
The one thing a report adds is the join between them, and the one thing it must not hide is which sources failed. If you learn nothing else here, learn to look for that column first — in the sample report or in a competitor's.
A vendor that shows you its failures is telling you something about how it will behave the week one of its integrations quietly stops answering.
Common questions
What are the most useful OSINT techniques?
Search operators, web archives, timestamps embedded in account IDs, and certificate transparency logs. All four are free, none depends on a vendor, and all have worked for years. Search operators are the highest-yield and the most often skipped, because they look too simple to be worth learning properly.
Why do OSINT tools stop working?
Because they wrap somebody else's service, and that service changes without notice. On this deployment, in a single day, Instagram stopped answering through every path, a paid breach API reported no credits, and three session-based checkers expired. The tools kept registering and returning nothing, which is worse than failing loudly.
How do search operators help find someone?
They stop the engine guessing. Quotation marks disable synonym matching so a handle is searched as a string; site: restricts to one domain and often beats that site's own search; filetype: finds documents rather than pages; and a minus sign removes a dominant meaning. Combined, they make a common name tractable.
Can you find deleted pages?
Usually. The Wayback Machine holds snapshots going back to 1996, so a cleaned-up profile or staff page is often intact there, along with when it changed. Absence proves nothing, though: the archive only holds what a crawler happened to visit, so a missing page may simply never have been captured.
How can you tell when an account was created?
On several large platforms the creation time is encoded in the account ID itself, Discord and Twitter among them, so an account with a hidden join date still carries its birthday in the number. Extracting it is arithmetic, not access, and it is one of the few facts nobody can edit afterwards.
What is certificate transparency used for?
Finding subdomains and infrastructure an organisation never linked anywhere. Every TLS certificate is written to public append-only logs so browsers can detect fraudulent ones, and crt.sh makes those searchable. Nobody can opt out, because the disclosure is a security feature the whole web depends on.
Which OSINT techniques are overrated?
Reading metadata from downloaded images, since every platform strips it on upload; elaborate sock puppet accounts, which cost enormous maintenance, carry legal exposure and get detected; and anything requiring somebody else's credentials, which is unauthorised access rather than a technique.
Is using these techniques legal?
Searching publicly available sources is legal in the United States and the EU, and doing it by hand rather than through a service changes nothing. Use is restricted: in the US, decisions about employment, housing, credit, insurance or tenancy fall under the Fair Credit Reporting Act. In the EU and UK, public personal data needs a lawful basis under GDPR.
