OSINT Investigation Checklist: From One Clue to a Defensible Finding

Write the decision before you search

Finish this sentence: “By the end of this investigation, I need to decide whether…” If the sentence ends with “find everything,” start again. “Does public evidence support that this sender is authorized to change a supplier’s payment details?” is narrow enough to investigate. “Who is this person really?” is usually too broad, too invasive and too easy to answer badly.

The United States Office of the Director of National Intelligence describes an intelligence cycle that moves through planning, collection, processing, analysis, dissemination and evaluation. The names are formal, but the practical lesson is simple: collecting material is only one stage. A folder full of screenshots is not yet intelligence. Read the ODNI consumer’s guide for the six-step model.

Create a case card before opening another source:

Decision:
Exact question:
Starting clue and where it came from:
Allowed public sources:
Actions outside scope:
What would count as enough evidence:
When I will stop:

This card prevents tool drift. It also gives you a reason to reject an interesting result that does not help answer the question.

The eight-question OSINT investigation checklist

1. What exactly am I trying to decide? Name the decision and the intended reader. A fraud reviewer, journalist and private buyer may need different levels of precision from the same public record.
2. What is the original clue? Keep the email, URL, username, image or claim exactly as received. Do not quietly “correct” a spelling or remove a subdomain; the odd part may be the useful part.
3. Which source can answer this part? Prefer a direct registry for a registered entity, the organization’s independently located contact page for an official channel, and the original post for a public statement. Ten pages copying one article still trace back to one source.
4. What did the source actually show? Record the visible field, source URL, source date when available and your retrieval time. “The page displays registration number X” is an observation. “The page belongs to company X” is an interpretation.
5. What link am I proposing? Say what connects the clue to the entity: same distinctive identifier, independently confirmed domain, reused public contact detail or matching chronology. A shared name is often weak; a verified registration number is more specific but still may not prove who controls a website.
6. What else could explain the match? Consider recycled phone numbers, shared hosting, copied company details, old pages, fan accounts, resellers and deliberate impersonation. An alternative explanation is not a defeat. It tells you what the next source must test.
7. Is the support independent? Two records are independent only if one did not simply copy the other. Follow citations to the underlying source and keep separate dates for historical and current evidence.
8. What would make me stop or change my mind? Define a stopping rule and one disconfirming test. If no possible result could weaken your conclusion, you are defending a story rather than testing a hypothesis.

The Berkeley Protocol on Digital Open Source Investigations addresses much higher-stakes human-rights work, but its emphasis on professional, legal and ethical collection, analysis and preservation is useful far beyond that setting. Adapt the rigor to the consequence of your decision; do not pretend a casual check is a forensic investigation.

Use an evidence staircase, not a pile of facts

Each useful finding should climb through six visible steps. If one step is missing, mark the gap instead of jumping over it.

A tool result is not a finding. A finding is an answer with its evidence and limits attached. This distinction is why “no result” can still be useful: it may rule out one route without proving the opposite.

Worked example: a real company name and an unverified request

This is a synthetic teaching case. The names, messages and reserved .example domains are fictional. It is not a customer story or an OSINT Jet output.

A message from billing@cedar-supply.example asks a buyer to replace the bank details used for future invoices. The signature names “Cedar Supply GmbH” and links to cedar-logistics.example. The research question is not “Does Cedar Supply GmbH exist?” It is: “Does public evidence support that this sender is authorized to change the payment instruction?”

The defensible interim finding is: “The register supports the existence of the named entity. The website repeats its details, but public evidence reviewed so far does not establish the sender’s authority to change payment instructions.” The practical next step is confirmation through a contact channel obtained independently of the request. Searching for more social profiles would add volume, not answer the decision.

Stop before research turns into browsing

Every pivot must pay rent: it should answer an unresolved question, test an alternative or locate a better source. Before opening a new tab, write the expected value in one line. If you cannot, return to the case card.

Use one of these stopping conditions:

• Decision reached: enough independent evidence supports a narrow answer at the consequence level required.
• Decision safely deferred: the key relationship remains unverified, and the report names the missing confirmation.
• Source boundary reached: the next step would require private access, contact with a person, paid data or an action outside the authorized scope.
• Diminishing returns: new searches repeat the same underlying sources without changing the finding.

“Unresolved” is a valid result when the evidence does not support a stronger answer. It is safer and more useful than confidence created by repetition.

Five habits that quietly weaken a case

Searching the conclusion. A query such as “Cedar Supply scam” asks the search engine to confirm a label. Search the observable elements separately: exact domain, registration number, claimed contact detail and message chronology.

Turning absence into proof. No social profile, archived page or search result does not prove that an entity is false. Say which sources and dates you checked, then describe the absence as a limit.

Collapsing entities too early. A company, website, email sender and named employee are four possible entities until evidence connects them. Keep separate rows for each. This small habit prevents a real company record from accidentally validating an unrelated domain.

Losing time context. A phone number can be valid in 2022 and reassigned later. A website can change owners. Attach a date to every important relationship and avoid mixing old and current observations in one present-tense claim.

Writing while still collecting. A polished narrative makes the first theory feel complete. Keep the evidence table neutral until the main alternatives have been tested; write the conclusion last.

Turn the checklist into a one-page handoff

QUESTION
What decision must this research support?

INPUTS
Exact clue | origin | received time | assumptions

EVIDENCE
ID | source | source date | retrieval time | exact observation

REASONING
Proposed link | alternative explanation | independent test

FINDING
Best-supported answer | supporting IDs | important limitation

NEXT STEP
One action that could change or confirm the finding

STOP REASON
Decision reached | deferred | boundary | diminishing returns

When the case is ready to share, move the evidence into the OSINT report template. The checklist controls the investigation; the report template controls the handoff.

Where OSINT Jet helps—and where a free source is enough

If one official record answers your question, use it and stop. A paid report would add no value. OSINT Jet becomes relevant when the case contains several domains, emails, usernames, company claims, dates and contradictions that need to remain connected to their sources.

The AI-assisted workflow is designed to organize supplied clues and public-source findings into relationships and a reviewable report. It does not turn an ambiguous match into a proven identity. Start with the question, exact identifiers and the strongest contradiction you need examined. Then review the resulting links against this checklist.

See how the OSINT Jet engine structures a case, practice on the OSINT training route, or read the responsible research boundaries.

Start a case with your question and source clues

Three questions beginners usually ask

Is an OSINT methodology just a list of tools?

No. Tools collect or transform information. Methodology decides the question, source, interpretation, test, stopping rule and report. You can replace a tool without changing the reasoning standard.

How many sources make a finding reliable?

There is no magic number. One direct authoritative record may be stronger than twenty copied articles. Judge independence, specificity, date, provenance and the consequence of being wrong.

Should I assign a confidence percentage?

Only if you have a defined, repeatable model that explains the number. Plain language is often clearer: name the direct support, the contradiction and the missing evidence that could change the answer.