OSINT, DECODED

OSINT methods and digital forensics for journalists and analysts

Sourced, repeatable methods, guides, reference cards and a weekly briefing from Signal & Shadow, written by Derek Bowler.

193

PIECES PUBLISHED

65 STEP-BY-STEP GUIDES

REFERENCE CARDS

TRAINING COURSES

Latest

The subject knows. Adjusting the AI prompt for counter-OSINT

AI in OSINT

Oct 23, 2026

The subject knows. Adjusting the AI prompt for counter-OSINT

Assess whether coordinated deletions and privacy changes across platforms point to a subject managing exposure or to routine account upkeep

Abyei drone strike: timing a market fire from orbit

The Signal

Oct 22, 2026

Abyei drone strike: timing a market fire from orbit

The record flagged Amiet by August. FIRMS fire detections time the strike in UTC. The army says fuel tankers; the map puts a market inside a UN area

Telecommunications infrastructure mapping and attribution

OSINT Cards

TELCO

Oct 21, 2026

Telecommunications infrastructure mapping and attribution

Query OpenCellID, Overpass Turbo and CellMapper across eight workflow steps to locate, attribute and document physical network assets

Capstone: tracking a sanctioned vessel from port to port

Document a sanctioned vessel's movements, identity changes and ownership chain using AIS data, Equasis, GISIS and sanctions lists

Derek Bowler

Email header analyzer: check if an email is genuine

Guides

Oct 19, 2026

Email header analyzer: check if an email is genuine

Read the Received path and SPF, DKIM and DMARC results to test where a suspect email really came from

Derek Bowler

Sanctions list search: how to check who is sanctioned

Financial Intelligence

Oct 18, 2026

Sanctions list search: how to check who is sanctioned

Run one name across the OFAC, UK, EU and UN lists, match identifiers and record a result that holds up

Derek Bowler

Meta Ad Library: how to investigate who is behind an ad

SOCMINT

Oct 17, 2026

Meta Ad Library: how to investigate who is behind an ad

Search the library, read Page transparency and pivot on disclaimers to trace who runs an ad and where

Derek Bowler

Riyadh airport strikes: the timeline Saudi alerts left out

The Signal

Oct 15, 2026

Riyadh airport strikes: the timeline Saudi alerts left out

The record held enough to flag Riyadh's deadliest strike two days early. Flight playback and NOTAMs keep the airport's own clock. Interception claims now sit beside an airport that kept closing

Derek Bowler

Armed group identification: attribution and tracking

OSINT Cards

Oct 14, 2026

Armed group identification: attribution and tracking

Geolocate armed group activity, map commander networks and trace supply chains to produce exhibit-ready attribution

Derek Bowler

OSINT in conflict zones: weapons, units and evidence

Methods

Oct 13, 2026

OSINT in conflict zones: weapons, units and evidence

Identify weapons, attribute units and geolocate conflict footage so your attribution holds up to scrutiny

Derek Bowler

License plate lookup: identify a vehicle from its plate

Guides

Oct 12, 2026

License plate lookup: identify a vehicle from its plate

Check a number plate against DVLA and MOT records, decode the VIN and test whether the vehicle really matches

Derek Bowler

OSINT methods and digital forensics for journalists and analysts

Latest

The subject knows. Adjusting the AI prompt for counter-OSINT

Abyei drone strike: timing a market fire from orbit

Telecommunications infrastructure mapping and attribution

Archive

Capstone: tracking a sanctioned vessel from port to port

Email header analyzer: check if an email is genuine

Sanctions list search: how to check who is sanctioned

Meta Ad Library: how to investigate who is behind an ad

Riyadh airport strikes: the timeline Saudi alerts left out

Armed group identification: attribution and tracking

OSINT in conflict zones: weapons, units and evidence

License plate lookup: identify a vehicle from its plate

Signal & Shadow