Level 2: OSINT Investigator – Course One: Attribution & Identity Tracing

Learn the structured process of identifying, validating, and attributing digital identities across platforms. This course equips learners with investigative techniques to track usernames, link digital trails, and confirm account ownership; all while maintaining legal and ethical standards.

Key objectives:

• Uncover hidden identities by tracing digital artifacts across the entire internet landscape.
• Decode hidden metadata and map connections with powerful visual link analysis.
• Preserve evidence with integrity and apply court-ready OSINT standards.

Course Topics

1. Introduction to Attribution Principles
   Master the legal and ethical boundaries that define responsible attribution — and learn how investigators connect digital activity to realworld identities.
2. Ethical and Legal Considerations of Using Breach Data
   Discover the fundamentals of breach data – what it is, where it comes from, and the ethical considerations of it’s use in OSINT investigations.
3. Data Breach Tools
   Harness specialized data breach tools to uncover exposed credentials, link accounts, and turn leaked data into actionable investigative
   intelligence.
4. Username Search Techniques
   Investigate usernames across social platforms, forums, breach databases, and meta-search aggregators to expose the full digital footprint.
5. OSINT in Action
   Connect the dots — use partial identifiers to trace origins, uncover hidden links, and cross-reference findings with powerful OSINT tools.
6. Account Attribution Framework
   Build airtight hypotheses by analyzing language patterns, timezones, behaviour, image reuse, metadata, and registration clues.
7. Identity Linkage via Data Analytics
   Surface powerful user correlations by exploiting hidden data points that others overlook.
8. Visual Link Analysis Tools
   Harness visual link analysis to map complex relationships, spot hidden patterns, and turn overwhelming data into clear investigative
   intelligence.
9. Image and Avatar Tracing
   Perform reverse image lookups using powerful tools to locate reused photos, stock images, or EXIF data linked to unidentified personas.
10. Exploring Metadata in Public Files
    Dig beneath the surface of PDFs, Word docs, and images — using tools like ExifTool and FOCA to extract hidden clues that reveal authorship,
    location, and more.
11. Investigating Email Headers
    Analyze email headers to identify originating IPs, mail routes, sending infrastructure, and metadata that attribute messages to their true
    source.
12. Account Creation Clues & Behavioural Fingerprinting
    Cross-reference user bios, writing style, platform behaviour, and activity timing to build a reliable behavioural fingerprint.
13. Fake Persona Red Flags & Sockpuppet Attribution
    Learn to identify the telltale signs of fake personas and attribute sockpuppet accounts using structural, behavioural, and linguistic analysis.
14. Legal Considerations & Evidential Reporting
    Apply rigorous evidence capture, documentation standards, and chain of custody protocols to produce attribution findings that hold up in
    legal proceedings.