OSINT Investigations

Updated 5 October 2026 by Investigation Bureau

Most modern investigations begin with open-source intelligence, and we run ours on tools we built and run ourselves. Identity attribution, digital footprints, due diligence and geospatial research, carried out by investigators and produced to an evidential standard, not printed off a subscription tool.

OSINT (open-source intelligence) is the discipline of collecting, verifying and analysing information from sources that are publicly available or lawfully licensed. That covers social media, corporate registries, court and property records, imagery, technical data about domains and devices, and the large archive of what people and companies have published about themselves online. In careful hands the result is evidence. In careless ones it is a screenshot. At Investigation Bureau, OSINT is a core part of how we investigate, not an add-on, and we build the tooling we use for it. The first conversation is free and confidential: send a confidential enquiry and we reply within one working day.

What OSINT can establish

Who is really behind a name, an account, a number or an email address. People reuse usernames and recycle photographs. Phone numbers and payment details tie together accounts that were supposed to stay apart. Lawful attribution connects a screen name to a real person, or tells you honestly that the connection cannot be made. It underpins our cyber investigation work on harassment, impersonation and scams.

Where someone is. Deep open-source research, combined with licensed data and field enquiries, is how professional people tracing locates people that free searches miss: a missing relative, a debtor, a beneficiary.

Whether a person or company is what they say they are. Registries, filings, litigation history, property records, sanctions lists, press coverage and the digital trail left by a business partner, a counterparty or a prospective executive. OSINT is the first phase of any corporate investigation or due diligence instruction we take on.

How a fraud was put together. Cloned websites, lookalike domains, mule accounts, fake trading platforms and the infrastructure behind an invoice-diversion attack all leave technical traces. Mapping those traces shows your bank, Report Fraud (the national reporting service that replaced Action Fraud) and your solicitor what actually happened.

What a place looks like before anyone goes there. Geospatial OSINT establishes the CCTV, road layout, transport patterns and public infrastructure around a location before a surveillance deployment. After an incident, it helps to reconstruct what was there.

What is exposed about you. A digital footprint assessment shows an executive, a family or a litigant what an adversary could learn about them from open sources, and what can be done about it.

Tools we built and run ourselves

OSINT is often run through a patchwork of browser tabs and rented subscriptions. We built our own in-house OSINT tooling instead, and designed it for evidence-led casework. It runs identity and username searches across a wide range of platforms, analyses email addresses, phone numbers and domains, pulls Companies House records into the case file and reads the metadata held inside images. A library of prepared searches takes much of the manual labour out of routine checks.

For geospatial work, the tooling plots what is publicly known about an area of ground, such as public CCTV positions, telephone masts and public Wi-Fi networks, so that a location is understood before anyone is sent to it. Every search is written to an append-only audit log with the operator's name against it, and that record is what gives a finding a chain of custody. The tooling runs on servers we control, so your subject's name is not sitting in a third-party vendor's logs. Read more about the technology behind our casework.

OSINT with investigators behind it

Judgement is the difference between an OSINT tool and an OSINT investigation. A matching username is somewhere to start, not something to conclude from. A company filing records a fact, not the whole story. Our OSINT work is run by the same investigators who run our fieldwork, and it moves into the physical world when a case needs it to: a trace confirmed by a visit, an attribution corroborated by covert surveillance, a due diligence finding tested through discreet enquiries. The desk work shows where to look. It takes an investigator to say what the findings mean.

Social media investigations

Lawfully gathered social media evidence is often decisive for employers, insurers and family-law clients. A claimant's public posts may contradict a claimed injury. An employee may be publicly active during certified sick leave. A counterparty's public associations may matter. We capture material that is genuinely public, with timestamps and context, and we record how it was obtained so that it survives a tribunal or a court.

We do not create fake profiles to befriend a subject. We do not ask for access to private content under false pretences. We do not access anything behind a login that is not ours. Evidence gathered in those ways is unlawful and worthless, and anyone who offers it to you is offering you a liability.

Digital footprint and exposure assessments

Executives, high-net-worth families and people involved in contentious litigation often need the question reversed: what could someone find out about me? An exposure assessment applies our full OSINT method to you or your organisation. It reports what is discoverable, from a home address in a company filing to family members identifiable through social media, and it sets out the practical steps that reduce it. For a board, the same assessment carried out on a senior appointment forms part of executive due diligence.

The boundaries we work within

What makes OSINT lawful is the origin of the information and the way it is handled. The limits are simple to state.

Every instruction is processed on a documented lawful basis under UK GDPR. We are registered with the ICO as a data controller (ZC259849). Where an investigation needs information that only a platform or a bank holds, the route is a court order such as a Norwich Pharmacal order, obtained through your solicitor. Our evidence is prepared to support that application.

What you receive

A written report that keeps what was found separate from what it means. Each finding is cited to its source. Captures are timestamped and preserved. The method is described plainly enough for a court to follow, and the report states how confident we are and what remains unknown. Where it matters, the audit log shows when each query was run and by whom. Our investigators can give evidence about how the material was obtained. If the honest answer is that attribution is not possible, or that the free checks you had already made were the right ones, the report says so and the bill reflects it.

Cost and timescale

The OSINT phase tends to be the least expensive part of an investigation, and in many cases nothing further is needed. After a free, confidential first conversation, every instruction is given a fixed quote in writing before any work begins, so you know the cost in advance. As a guide to the UK market, a standard people trace is typically a fixed fee of £150 to £500, and we offer no trace, no fee on suitable tracing cases. Verification work, such as employment background checks and identity verification, is quoted as a fixed price once we know the scope. Desk-based OSINT work is usually delivered within days, so tell us if it is urgent. Larger due diligence and attribution instructions are scoped and timetabled individually.

Frequently asked questions

What is OSINT?

OSINT stands for open-source intelligence. It means information gathered from publicly available or lawfully licensed sources and analysed into something useful. In a private investigation the sources include social media, corporate and court records, property and electoral data, imagery, domain and device information, and what people have published about themselves. An investigator verifies and cross-references all of it. Nothing is taken at face value.

Is OSINT legal in the UK?

Yes, provided it draws on information that is public or licensed for the purpose and is processed under a documented lawful basis. What is unlawful is getting round access controls, obtaining personal data by deception, buying stolen data, or using the results to harass someone. We work entirely inside those limits. We are registered with the ICO as a data controller (ZC259849).

Can OSINT find someone's address?

Often, when it is combined with licensed data and field enquiries, and only where there is a legitimate purpose such as a debt, a legal claim, a family reunion or a beneficiary trace. Every tracing instruction is screened for signs of stalking or harassment, and we decline those that fail. Where the person may not want contact, we use a welfare check or an intermediated approach and do not simply hand over an address.

Can you find out who is behind an anonymous or fake account?

Frequently. Lawful attribution works from reused usernames, recycled photographs, linked phone numbers and payment details, writing habits and technical traces. A careless account can be attributed quickly. A careful and determined operator sometimes cannot be attributed at all, and we will tell you that instead of charging you to discover it slowly. Where attribution depends on data that a platform holds, we build the evidence for a court application made through your solicitor.

Do you use AI in OSINT investigations?

Yes, as an assistant to the analyst. AI tools help our investigators sift large volumes of lawfully gathered material, spot patterns and draft summaries. A human investigator verifies every finding against its source before it goes into a report. No conclusion rests on an AI output that cannot be traced back to evidence.

How long does an OSINT investigation take?

Most desk-based instructions are delivered within days. That includes an attribution, a footprint assessment or the OSINT phase of a due diligence report. Complex due diligence and the mapping of fraud infrastructure take longer, and we scope and timetable them in the free first conversation. Cross-border work is handled with trusted partners.

What does an OSINT investigation cost?

A fixed price, quoted in writing before any work begins. In the UK market a standard trace is typically £150 to £500, and no trace, no fee applies on suitable tracing cases. Verification work and bespoke OSINT instructions are quoted on scope after a free first conversation.

Find out who, where or whether. Talk to an investigator in confidence. It is free, carries no obligation, and you will get an honest view of what open sources can and cannot establish: start a confidential enquiry.

Related reading: The technology behind our casework · Cyber investigations · People tracing · Corporate investigations and due diligence · How do private investigators find people?