Three days before the incident, the subject updated their LinkedIn profile. The job title changed. The company affiliation was adjusted. An endorsement section was quietly removed. That sequence means something: it does not mean what it looks like without a structured read.
The problem
Professional profile updates are routine. People change jobs, refresh summaries, add certifications, and remove outdated affiliations continuously, and most of those changes have nothing to do with whatever the investigator is looking at. The problem is that when a significant professional event precedes or follows an incident under investigation, the investigator needs to assess whether the timing is meaningful, and that assessment is harder than it looks.
An analyst who sees "profile updated three days before the incident" has a story forming before the analysis begins. That story may be right (preparatory profile edits ahead of a planned departure, reputation-management moves ahead of anticipated scrutiny), but it may also be wrong. Routine annual updates, LinkedIn's own automated suggestions, connections endorsing skills and triggering a notification, career milestones coinciding with no investigative relevance: all of these produce the same observable output as a meaningful pre-incident edit. The timing is real. The implication is not self-evident.
What the analyst needs is a structured assessment of each specific change against the plausible explanations for it, weighted by the timing. Not "the profile was updated three days before the incident" as a finding: that is an observation. But "the job title change and the removal of the endorsement section, taken together, are more consistent with preparatory reputation management than with routine maintenance" is an assessment, and it requires more than proximity analysis to produce honestly.
The rest of this tutorial is for Signal subscribers.
What remains: the decision framework, the tool configuration, the failure modes, and the evidentiary standard required to use the finding defensibly. Signal is €90 a year, or €9 a month. Students, €49 a year.
Join SignalA Signal subscription gives you:
- Full OSINT Reference Card library, 21 domains
- Methods, every tradecraft tutorial in full
- AI in OSINT, every prompt and field report
- Shadow Analysis, every forensic dossier
