One email address. Four breach records spanning a decade. Four different names attached. The question is not which is real — it is which patterns the records describe and which name belongs to the address's persistent owner.
The problem
An email address looks like a stable identifier. It is not. Over a decade an address may be used by its owner under one name, used by a partner or family member under another, recycled by the provider after a deletion event, given falsely at signup by someone who wanted a real-looking address that was not theirs, or rebranded by the owner themselves across life transitions. A breach data set capturing the address at one point in time records the name attached to it on that day at that service. A second breach set captures the address attached to a different name two years later. Both records are real. They describe different states of the world.
The standard manual approach is to look at the four records and pick the name that appears most often. This rewards the wrong signal. A persistent owner who used the address quietly for personal communications may show up in fewer breach sets than a single high-profile signup the owner made under a real-looking pseudonym. Frequency does not establish ownership. Temporal continuity does. Cross-record corroboration does. Service-type signal does. The analyst needs all three in one view.
What is needed is a chronological timeline that places each breach record in temporal order, surfaces the identity signals each record carries, and assesses for each name whether it represents persistent ownership, transient co-occupation, or noise. The prompt in this piece produces that timeline.
This tutorial is for Signal subscribers.
Methods goes deep on a single technique each fortnight. The decision framework, the tools, the failure modes, and the evidentiary standard required to use the finding defensibly.
Join SignalA Signal subscription gives you:
- Full OSINT Reference Card library
- Methods, all tradecraft tutorials in full
- Shadow Analysis, all evidence-based reporting
- Forensic Dossiers, full access
- Discord access included
