# Learn OSINT with OTInstaller How an OSINT investigation runs, from scope to report; opsec and legal basics for the investigator; and the order to read the investigation playbooks in. OSINT means answering a question from information anyone can lawfully get to. The tools are the easy part; the method is what makes a finding hold up. This page is the method in short, what to watch for your own safety and the law, and the order to read the guides in. ## How an investigation runs ### 1. Scope Write down the question you need answered and why you may ask it, before you run anything. A scope keeps you from collecting what you don't need, and tells you when you're done. [Scope and legal, from the username playbook](https://otinstaller.com/guides/osintverse-community/username-investigation/01-scope-and-legal) · [Acceptable use](https://otinstaller.com/policy/acceptable-use) ### 2. Collect Start from what you have: an email address, a username, a phone number, a domain, an IP address or an image. Use passive tools first: ones that work offline or read public sources without touching the target. Each tool page says what it contacts under Behaviour. [Email tools](https://otinstaller.com/input/email) · [Username tools](https://otinstaller.com/input/username) · [Domain tools](https://otinstaller.com/input/domain) · [Phone tools](https://otinstaller.com/input/phone) ### 3. Pivot Every result holds new identifiers: an email address in a profile, a domain in an email address, a username in a bio. `ot pivot ` and the "What next" list on each tool page name the tools that take them. [Saved results and pivots](https://otinstaller.com/docs/results) · [Pivoting from an email address](https://otinstaller.com/guides/osintverse-community/email-investigation/05-pivot) ### 4. Verify A hit is a lead, not an identification. Confirm each finding with at least two independent links to what you already know, and mark it confirmed, likely or unrelated, with why. [Verify and pivot](https://otinstaller.com/guides/osintverse-community/username-investigation/04-verify-and-pivot) · [Finding earlier copies of an image](https://otinstaller.com/guides/osintverse-community/image-geolocation/03-copies) ### 5. Record Keep what answers the question, with the date, the tool and version, and how you found it. `ot run` saves every run with its `run_id`, the tool's digest and a hash of exactly what the tool printed; `--case` keeps a case's runs together. [What a run saves](https://otinstaller.com/docs/results) · [Preserving what a profile shows](https://otinstaller.com/guides/osintverse-community/social-media-profiles/04-preserve) ### 6. Report Say what you found, how sure you are and how you know. Cite runs by their `run_id` so someone else can check them. When the case closes, delete what you collected and no longer need. [Pulling indicators out of saved runs](https://otinstaller.com/docs/results) ## Opsec for the investigator - `ot` runs each tool in a container that can't read your files, with no network unless the tool needs it, and passes each API key only to the tool that declares it. - It doesn't hide your IP address. The sites and services a tool contacts see where the request came from. If that matters for your case, run `ot` from a server or through a VPN you are allowed to use. - Some tools contact the target or may notify them, such as a password-reset or sign-up check. The tool page and `ot info` say so under Behaviour, and agents and scripts must ask before running them. - Keep investigation accounts and API keys apart from personal ones. `ot keys` stores keys in your system keychain. - Results can hold personal data. Keep them on an encrypted disk, grouped by case, and out of folders that sync to the cloud. ## Legal and ethical basics - Have a purpose and a lawful basis. Journalism, a fraud investigation, due diligence and a security assessment you were hired for each have their own rules. Check the law where you are and where the person is. - Information about a person is personal data in most places (GDPR in the EU and UK, privacy laws elsewhere). Collect only what answers your question and delete the rest. - Respect the services you use: no fake accounts to see more, no logins you aren't entitled to, no getting round access controls. - Never use what you find to contact, harass, stalk or expose anyone. The [acceptable use policy](https://otinstaller.com/policy/acceptable-use) applies to every tool and guide here. - This page is general information, not legal advice. ## What to read, in order ### Start here Install `ot`, run a first tool and see what the registry can do. - [Quick start](https://otinstaller.com/docs/quick-start) - [What you can do](https://otinstaller.com/tour) - [Getting started](https://otinstaller.com/docs/getting-started) ### Beginner playbooks One identifier each, step by step, passive first. - [Username investigation](https://otinstaller.com/guides/osintverse-community/username-investigation) - [Email investigation](https://otinstaller.com/guides/osintverse-community/email-investigation) - [Phone number investigation](https://otinstaller.com/guides/osintverse-community/phone-investigation) - [Social media profiles](https://otinstaller.com/guides/osintverse-community/social-media-profiles) ### Intermediate playbooks Infrastructure, images and money: more tools, more care with what you touch. - [Domain investigation](https://otinstaller.com/guides/osintverse-community/domain-investigation) - [IP address investigation](https://otinstaller.com/guides/osintverse-community/ip-investigation) - [Image verification and geolocation](https://otinstaller.com/guides/osintverse-community/image-geolocation) - [Cryptocurrency address tracing](https://otinstaller.com/guides/osintverse-community/crypto-address-tracing) ### Go further Batch runs, saved results, automation, AI agents, and tools without Docker. - [Saved results and pivots](https://otinstaller.com/docs/results) - [Scripts, CI and agents](https://otinstaller.com/docs/automation) - [AI agents](https://otinstaller.com/agents) - [otlite, no Docker](https://otinstaller.com/otlite) ### Give back Package a tool you rely on, or write down how you investigate. - [Publish your first tool](https://otinstaller.com/guides/osintverse-community/publish-your-first-tool) - [Publish a guide](https://otinstaller.com/guides/osintverse-community/publish-a-guide) - [How publishing works](https://otinstaller.com/docs/publishing)