Free OSINT Tools for Digital Investigations
/Unlike many conference sessions at the 37th Annual ACFE Global Fraud Conference that focused on case studies or fraud trends, Anthony Lisek's presentation was a live demonstration of open-source intelligence (OSINT) techniques that attendees can immediately incorporate into their own investigations.
Lisek walked participants through a wide range of free tools and investigative methods that can be used to identify digital footprints and uncover publicly available information, drawing on his experience as lead investigator for insider threat at Airbnb.
Because the session was highly technical and included live demonstrations, attendees who would like to revisit the material will be able to access the presentation again when on-demand recordings become available in the coming weeks.
Building “Digital Profiles” Through Public Data
Lisek opened the session by demonstrating how investigators can extract unique user identification numbers from social media platforms by viewing a profile page’s source. User identification numbers remain constant and can help investigators confirm identities across multiple platforms, unlike usernames, which can be changed.
He then showed attendees how AI tools can generate browser bookmarklets that show information such as user IDs, usernames and profile URLs. Similar techniques can be adapted for different social media platforms.
Throughout the session, Lisek reminded attendees that manually verifying information remains an important first step before relying on automated tools like ChatGPT.
Looking Beyond Social Media
The demonstration then expanded beyond social media to highlight the wide range of publicly available information that can support fraud investigations.
Lisek walked attendees through how investigators can identify website registration details to determine when domains were created and how to uncover connections between websites using free online tools. He also demonstrated how resumes, public profiles and data aggregators can reveal valuable information about someone’s employment history.
"If high-level intelligence professionals are leaving their information out in the open, so are fraudsters,” said Lisek.
He encouraged attendees to think about where information may exist and explained that seemingly insignificant pieces of public data can become valuable when combined with information from other sources.
Connecting Evidence
Another major focus of the session was documenting investigative findings.
Lisek demonstrated techniques for preserving webpages, such as extracting metadata and organizing digital evidence throughout an investigation. He also walked attendees through methods for identifying hidden information embedded in images using steganography tools, explaining how investigators can encode and decode concealed messages hidden within images.
He further demonstrated how publicly available information from Google Maps, Strava and PayPal can provide additional investigative leads. In one example, he showed how activity data and publicly shared location information could be used to reconstruct movements and identify potential connections between individuals.
The session concluded with a demonstration of how investigators can organize large amounts of collected information by creating relationship maps and visualizing interactions in an Excel spreadsheet. By connecting social media activity and publicly available records, investigators can identify patterns that might otherwise remain hidden.
Throughout the presentation, Lisek repeated that effective OSINT investigations are about combining multiple publicly available sources to build a more complete picture.
While the tools demonstrated during this session may evolve, Lisek encouraged attendees to focus on developing an investigative mindset that continuously asks where additional information might exist.
