The Tor network is a layered anonymity architecture that routes traffic through a chain of volunteer-operated relays, encrypting each hop so that no single node knows both the origin and destination of a connection. For investigators, Tor is not primarily a privacy tool: it is the access layer for .onion hidden services, the delivery mechanism for anonymous source submissions via SecureDrop, and the infrastructure underpinning legitimate journalism platforms operated by outlets including ProPublica and the BBC. Knowing how Tor works, where it fails, and how to use it without compromising an investigation is a prerequisite for any dark web research workflow.
Tor access is appropriate when a target site is unreachable via standard browsers, when source identity requires protection, or when institutional IP exposure would compromise an operation. The network imposes operational constraints, and those constraints shape investigative method: a maximised browser window reveals screen resolution; a personal account login immediately deanonymises a session; a document opened outside the sandboxed environment can connect to clearnet infrastructure. Each constraint, treated in isolation, appears manageable. The pattern of failures, when any one is overlooked, is not.
DRK-002 sets out the methodology for accessing, documenting, and preserving dark web content to evidentiary standard.
Eight workflow steps, six tooling sources, five false-positive checks, six chain-of-custody requirements.
|
01
Required Tools
Six tools covering Tor access, live OS, search, and metadata stripping.
|
02
OPSEC
Session hygiene, browser constraints, and deanonymisation vectors.
|
|
03
Workflow
Eight-step sequence from environment setup to pre-publication verification.
|
04
False Positives
Honeypots, impostors, exit scams, and rotating exit node attribution.
|
|
05
Chain of Custody
Six requirements covering address logging, hashing, and read-only archiving.
|
06
Key Queries
Five operator references across Ahmia, OnionSearch, blockchain, HIBP, and ExifTool.
|
Download the card.
A PDF version of DRK-002 is available below for Signal subscribers.
The rest of this card is for Signal subscribers.
What remains: the step sequence, the tool list, the false-positive checks and the chain-of-custody note. Signal is €90 a year, or €9 a month. Students, €49 a year.
Join SignalSignal includes:
- Full OSINT Reference Card library, 21 domains
- Methods, every tradecraft tutorial in full
- AI in OSINT, every prompt and field report
- Shadow Analysis, every forensic dossier
- OSINT Hub community access
