Methodology & best practices

Osintracker gives you the canvas; method is what turns a pile of nodes into an investigation that holds up. This page suggests a workflow and conventions that make your graphs readable, your conclusions defensible, and your work shareable.

The investigation lifecycle

A useful OSINT investigation tends to move through five phases. Osintracker supports each one.

1. Define — write the objective and scope before collecting anything. Put it in the investigation description so it stays visible.
2. Collect — gather from open sources; bring data in via manual entry, import or connectors.
3. Structure — model what you found as typed entities and sourced relationships.
4. Analyse — pivot, look for clusters and gaps, mark what's confirmed vs. uncertain.
5. Report — export a clean deliverable and back up.

Structure as you go

The graph is only as useful as the discipline behind it.

• Pick the right type. Use the most specific entity type available (e.g. Social Network › Instagram rather than Generic › other). Types drive icons, colours and which resources appear.
• One fact, one entity. Don't overload a single node; create separate entities and link them.
• Use aliases. Put the canonical value in Value and a human-readable name in Alias so the graph stays legible.
• Write descriptions. The description field is your reasoning trail — why this entity matters, what's confirmed, what's a lead.

Source everything

The most important habit in OSINT: record where each claim comes from.

• Fill the source field on relationships, and reference URLs/archives in descriptions and comments.
• When a lead turns out to be wrong, don't delete it — mark the entity with the False positive badge so the dead end is documented.
• Prefer archived links (the Internet › archive type) over live URLs that may change.

A convention for visual attributes

Osintracker's visual attributes only help if you use them consistently. A suggested scheme:

Attribute	Suggested meaning
Critical (red outline)	Central or high-importance element
Rating (0–3)	Confidence / strength of the link (also thickens edges)
Progress badge	Verification status: Pending → Question → Done, or False positive / Stop
Colour	A dimension that matters to your case (e.g. faction, organisation, time period)
Size	Visual emphasis for key nodes

Write your chosen convention into the investigation description so collaborators read it the same way. The colour legend on the graph documents your colour choices automatically.

Pivoting

Pivoting is moving from one identifier to new ones. In Osintracker:

• From an entity's detail panel, run the resources matched to its type (e.g. a username lookup).
• Enrich an email/phone/username with a connector to pull linked accounts and profiles in one import.
• Connect every newly found entity back to its origin with a sourced relationship so the chain of discovery is preserved.

Tailor your toolset

Different cases need different tools. Build a resource set per investigation type (cyber, financial, journalistic…) so the right tools surface in the detail panel from the start. Share sets with your team by exporting them as a CSV resource file.

Ethics and legality

OSINT uses open sources, but "open" is not the same as "anything goes".

• Stay passive. Collect from publicly available sources. Do not log in to others' accounts, guess passwords, or access anything requiring authorisation — that's no longer OSINT.
• Respect terms of service of the platforms and tools you use.
• Lawful basis & minimisation. Have a legitimate purpose and collect only what you need. Under the GDPR, processing personal data carries obligations even though Osintracker stores everything locally — see Privacy & data → Your responsibilities.
• Protect sources and subjects. Be mindful of the harm careless handling can cause.
• Keep a clean record. Sourced, dated, well-described entities make your work auditable and defensible.

For protecting yourself and your investigation while you work, continue to Operational security.

Report and preserve

• Export an HTML or Markdown report for a readable deliverable, CSV/JSON for further processing, or a PNG of the graph for a visual summary — see Import & Export.
• Keep a .osintracker backup of the full case, and store it securely.