Learn
Learn OSINT, one step at a time
OSINT means answering a question from information anyone can lawfully get to. The tools are the easy part; the method is what makes a finding hold up. Here is the method in short, what to watch for your own safety and the law, and the order to read the guides in.
How an investigation runs
Scope
Write down the question you need answered and why you may ask it, before you run anything. A scope keeps you from collecting what you don't need, and tells you when you're done.
Scope and legal, from the username playbook · Acceptable use
Collect
Start from what you have: an email address, a username, a phone number, a domain, an IP address or an image. Use passive tools first: ones that work offline or read public sources without touching the target. Each tool page says what it contacts under Behaviour.
Pivot
Every result holds new identifiers: an email address in a profile, a domain in an email address, a username in a bio.
ot pivot <run>and the "What next" list on each tool page name the tools that take them.Verify
A hit is a lead, not an identification. Confirm each finding with at least two independent links to what you already know, and mark it confirmed, likely or unrelated, with why.
Record
Keep what answers the question, with the date, the tool and version, and how you found it.
ot runsaves every run with itsrun_id, the tool's digest and a hash of exactly what the tool printed;--casekeeps a case's runs together.Report
Say what you found, how sure you are and how you know. Cite runs by their
run_idso someone else can check them. When the case closes, delete what you collected and no longer need.
Opsec for the investigator
otruns each tool in a container that can't read your files, with no network unless the tool needs it, and passes each API key only to the tool that declares it.- It doesn't hide your IP address. The sites and services a tool contacts see where the request came from. If that matters for your case, run
otfrom a server or through a VPN you are allowed to use. - Some tools contact the target or may notify them, such as a password-reset or sign-up check. The tool page and
ot infosay so under Behaviour, and agents and scripts must ask before running them. - Keep investigation accounts and API keys apart from personal ones.
ot keysstores keys in your system keychain. - Results can hold personal data. Keep them on an encrypted disk, grouped by case, and out of folders that sync to the cloud.
Legal and ethical basics
- Have a purpose and a lawful basis. Journalism, a fraud investigation, due diligence and a security assessment you were hired for each have their own rules. Check the law where you are and where the person is.
- Information about a person is personal data in most places (GDPR in the EU and UK, privacy laws elsewhere). Collect only what answers your question and delete the rest.
- Respect the services you use: no fake accounts to see more, no logins you aren't entitled to, no getting round access controls.
- Never use what you find to contact, harass, stalk or expose anyone. The acceptable use policy applies to every tool and guide here.
- This page is general information, not legal advice.
What to read, in order
Start here
Install
ot, run a first tool and see what the registry can do.Beginner playbooks
One identifier each, step by step, passive first.
Intermediate playbooks
Infrastructure, images and money: more tools, more care with what you touch.
Go further
Batch runs, saved results, automation, AI agents, and tools without Docker.
Give back
Package a tool you rely on, or write down how you investigate.