GDE-003 |
Aircraft investigation | |||||||
Aviation intelligence | ||||||||
June 2026 | ||||||||
01
What it is
Aviation OSINT is the structured use of civil aviation registries, ADS-B flight tracking data, and ownership databases to trace an aircraft from its tail number through its operator, registered owner, and ultimate beneficial owner. It applies to private jets, surveillance aircraft, government-linked flights, and any situation where the official record of who operates an aircraft needs to be independently verified.
Before using Flightradar24 to check whether an aircraft is airborne, check ADS-B Exchange first. The two platforms draw from different receiver networks. More importantly, operators of private aircraft in the US can enrol in the FAA's LADD programme to suppress their flight data from commercial tracking platforms including Flightradar24. A jet that appears grounded on Flightradar24 may be actively broadcasting on ADS-B Exchange, which carries unfiltered data regardless of LADD enrolment. That distinction produced findings in the reporting on Jeffrey Epstein's Gulfstream G-IV, where historical ADS-B data confirmed flight patterns that the registered operator had not disclosed. It has been the difference between a finding and a dead end in multiple subsequent investigations. This guide covers how to work systematically from tail number to ownership, and how to handle the gaps the system is designed to create.
|
When to use this guide
|
02
How to investigate an aircraft: from tail number to ownership
A five-step workflow from identifier retrieval through ADS-B tracking, registry research, ownership tracing, and evidentiary documentation.
Aircraft have four distinct identifiers, each useful for different investigative purposes. The registration number, painted on the tail, is the starting point for most investigations and links directly to civil aviation registry records. The ICAO hex code is a unique 24-bit address broadcast by the aircraft's Mode-S transponder and is the anchor for ADS-B flight tracking data. The manufacturer serial number (MSN) is stamped into the airframe at construction and never changes, even as registration numbers and owners change over decades. The call sign is a temporary operational identifier used during flight operations that changes with each operator and sometimes each flight.
For investigative purposes, the most durable identifier is the ICAO hex code for real-time and historical flight tracking, and the MSN for long-term ownership tracing across jurisdictions. The tail number is the fastest entry point but can be changed on re-registration, so confirmation against the hex code and MSN closes the chain.
The following tools are used across the steps below. All are free unless noted.
Flightradar24: Real-time and historical ADS-B flight tracking platform. Searches by registration, ICAO hex code, or call sign. Free tier provides basic live tracking; 365-day history requires a paid subscription. Subject to LADD suppression for enrolled US operators.
OpenSky Network: Non-profit community ADS-B receiver network providing free API access to multi-year historical flight data. Better for research and bulk queries than consumer tracking. Free, with registration for API access.
FAA Aircraft Registry: US civil aviation registry. Search by N-number to retrieve registered owner name, address, aircraft make, model, year, ICAO hex code, and registration status. Free, updated each working day.
Planespotters: Aviation image and data database covering over 50,000 aircraft with full ownership history, operator records, and user-submitted photographs. Particularly useful for non-US aircraft where national registries are less accessible. Free.
JetPhotos: Photo archive of over 6 million aircraft images, searchable by registration number. Used to visually corroborate registration markings and confirm aircraft livery, tail number changes, and operator branding across time. Free.
|
Before you begin Always check ADS-B Exchange alongside Flightradar24. US operators can suppress their data from commercial tracking platforms via the FAA's LADD programme. ADS-B Exchange carries unfiltered data. If an aircraft of investigative interest does not appear on Flightradar24, check ADS-B Exchange before concluding the aircraft was not airborne. Anchor on the ICAO hex code and MSN. Registration numbers change. The ICAO hex code and manufacturer serial number do not. Retrieve both early and anchor all flight tracking queries to the hex code. For ownership tracing across years, the MSN is the only persistent airframe identifier. |
Start with the tail number (registration number) from your source material. Search it on Flightradar24 to retrieve the ICAO hex code. Cross-reference the hex code against the FAA Aircraft Registry (for US-registered aircraft) or the relevant national civil aviation authority to confirm the registration record. Note the aircraft make, model, year of build, and MSN from the registry record. If the tail number has changed recently, the old registration may still be searchable on Planespotters, which maintains ownership history. Record all three identifiers (tail number, hex code, MSN) before proceeding to flight tracking.
Query Flightradar24 by ICAO hex code for flight history. If the aircraft does not appear or shows limited data, query ADS-B Exchange immediately: the absence of data on Flightradar24 combined with presence on ADS-B Exchange confirms LADD enrolment, which is itself an investigatively significant finding. For bulk historical queries or API access to multi-year records, use OpenSky Network. Note the departure and destination airports, routing, altitude profiles, and any anomalous behaviour such as transponder-off segments or repeated routes to the same destination.
Retrieve the full registration record from the FAA Aircraft Registry or the relevant national authority. Note the registered owner name and address. For US private aircraft, the registered owner is frequently a Delaware or Nevada trust whose beneficial owner is not disclosed in the registry record. Cross-reference the registration address against company registry databases to identify the trust administrator or formation agent. Search the aircraft on Planespotters for the full prior ownership history using the MSN: tail number changes do not disrupt the ownership chain when tracked by MSN. Search JetPhotos by registration number to confirm livery and tail markings across time.
Trace the registered owner (trust or corporate entity) through OpenCorporates and the relevant state corporate registry. For Delaware trusts, check the Delaware Division of Corporations for the registered agent name and address. A registered agent appearing across dozens of aviation trusts is a service provider link rather than a beneficial owner. Run all identified individuals and entities through OpenSanctions and the OFAC SDN List. For the full corporate ownership tracing methodology, see the corporate investigation guide and COR-001.
Screenshot FAA registry and national registry results at the time of access with the URL and timestamp visible. Screenshot Flightradar24 and ADS-B Exchange flight records for each flight of interest, including the search parameters used. Download and hash OpenSky API output files and record the query, the hex code used, and the date of the query. Save copies of JetPhotos and Planespotters photographs with the URL, photographer credit, date, and location metadata. Archive OFAC and EU sanctions list search results via the Wayback Machine at the time of the search.
|
03
What to watch for in aviation OSINT
Common false positives, evidentiary traps, and chain of custody requirements specific to aircraft investigation.
N-number reassignment: In the US, N-numbers are reassigned to different aircraft after a registration is cancelled or allowed to expire. A historical news article referencing a specific N-number may be describing a completely different physical aircraft than the one currently carrying that number. Verifying check: Cross-reference the N-number against the ICAO hex code and MSN at each point in time. If the hex code or MSN in a historical record does not match the current registration record, the N-number has been reassigned. The MSN is the only persistent airframe identifier across reassignments.
Registered owner versus operator: The name appearing on a civil aviation registry record is the registrant, not necessarily the operator or beneficial owner. US private aircraft are frequently held in Delaware or Nevada trusts whose beneficial owners are not publicly disclosed. The registered address may be a law firm or trust company rather than the aircraft's base of operations. Verifying check: Treat the registered owner as a starting point, not a conclusion. If the registrant is a trust or corporate entity, trace that entity through company registry records and the ICIJ Offshore Leaks database before drawing any attribution conclusions.
ADS-B coverage gaps: ADS-B receiver networks have coverage gaps over oceans, remote terrain, and certain regions with low receiver density. An aircraft that does not appear in ADS-B records for a specific period may have flown during that period without being tracked, rather than not having flown at all. Verifying check: Check OpenSky Network in addition to Flightradar24; the two networks draw from different receiver pools. Note coverage limitations explicitly in any evidentiary record.
LADD and data-blocked aircraft: In the US, operators can enrol in the FAA's LADD programme to suppress their flight data from commercial tracking platforms including Flightradar24. These aircraft still broadcast ADS-B and still appear on ADS-B Exchange. A flight appearing on ADS-B Exchange but not on Flightradar24 indicates LADD enrolment, not the absence of flight data. Verifying check: Always check ADS-B Exchange before concluding an aircraft was not airborne. LADD enrolment itself is not secret; it can be confirmed by cross-referencing the aircraft against the FAA's published LADD list.
Chain of custody: ADS-B data, registry records, and aviation photographs all require timestamped capture for evidentiary purposes.
Screenshot FAA registry results and national registry pages at the time of access with the URL and timestamp visible.
Screenshot Flightradar24 and ADS-B Exchange flight records for each flight of interest, including the search parameters used.
Download and hash OpenSky API output files and record the query, the hex code used, and the date of the query.
Save copies of JetPhotos and Planespotters photographs with the URL, photographer credit, date, and location metadata.
Archive OFAC and EU sanctions list search results via the Wayback Machine at the time of the search and record the capture URL.
04
Go deeper
Each reference card used in this guide is available individually in the archive. Every card covers the full workflow, key queries, OPSEC controls, false positives, and chain of custody requirements for the technique.
AVI-001
Aviation OSINT: flight tracking to evidentiary standard.
ADS-B Exchange, Flightradar24, and Icarus Flights. Tail number queries, platform cross-referencing, and LADD suppression checks.
COR-001
Company registry research across jurisdictions.
Companies House, OpenCorporates, and Orbis. The corporate registry methodology that applies when aircraft ownership terminates in a trust or shell company.
Evidentiary standard
Signal & Shadow operates to the LST-001 evidentiary standard. All claims are graded against the LST-001 v1.0.3 confidence tiers (Confirmed, Corroborated, Reported, Alleged) per the canonical voice and structural specification.
About Signal & Shadow
Signal & Shadow is an independent forensic investigation and methodology practice publishing tutorials, reference cards, and forensic dossiers for working practitioners. Founded by Derek Bowler.