OSINT practice
Check the claim. Show the working.
Original OSINT practice exercises built around verification, geolocation and identity resolution. Each one has a briefing, tasks, hints and a hidden solution, and each is rated for newcomers and for experienced investigators.
- 6 exercises
- 6 blog posts
$ verify --claim "photo shows the harbour at dawn"
sourceEarliest copy found is three weeks older than the post
metadataStripped. No location or time to rely on
geolocationSkyline and ridge line match the north shore
verdictPARTIALPlace holds. Date unverified.
$
Start here
Exercise 002 - about 35 min
Same handle, different person
A committee wants to know if a new forum member is a known blogger. A username search says five sites match. How many really do?
A good first exercise: it needs a notes document and nothing else.
Latest exercises
All exercisesExercise 006 · about 35 min
Five reports, one origin
Trace five fictional articles back to their origins. Separate a source's track record from support for a claim, and keep a conflicting date unresolved.
Novice 4/5Expert 2/5verificationsource tracingcorroborationExercise 005 · about 45 min
Same month, different case
A machine report calls a string of municipal arrests one investigation. Test each link, read the machine's own numbers, and decide what the evidence supports.
Novice 4/5Expert 2/5verificationmachine outputlink analysissearch recallExercise 004 · about 35 min
One arrest, wrong map
An automated report ties one arrest to a regional fraud network. Check each claim against five sources and find where it put the wrong person on the wrong map.
Novice 3/5Expert 1/5verificationmachine outputclaim checkingidentity resolution
The method behind the exercises
Every exercise is built around the same three steps, and the hidden solution shows the working.
01
UnverifiedClaim
Write down exactly what is being asserted: a photo, a quote, a profile, a date. A vague claim cannot be checked.
02
CheckingEvidence
Collect what can be tested: sources, metadata, geography, timelines. Record what is missing as well as what is found.
03
VerifiedPartialDisputedVerdict
Say what the evidence supports and no more. A partial answer is allowed, and so is not knowing yet.