Blog · OSINT & verification

OSINT Examples: 8 Techniques You Can Try Today

Open the map →

Ask what open-source intelligence looks like in practice and you usually get a list of tools. Tools are the least interesting part. What an analyst actually owns is a set of techniques (repeatable ways of turning something public into something proven) and the only way to learn them is to run them yourself.

So this is a workbench, not a gallery. Eight OSINT examples, each one a small anonymised scenario plus the steps to reproduce it with free, open sources. If you want the concept first (what OSINT is, how it differs from the other intelligence disciplines and what counts as an open source) read the pillar guide and come back. Everything below assumes you have the definition and want the craft.

The essentials, in 20 seconds

• Eight techniques: each pairs a public, free source with an honest note on what it cannot prove.
• Two independent features: photo geolocation only holds once two matching details line up, not one.
• Shadows: chronolocation narrows a photo to a window of plausible times, never a single timestamp.
• AIS gaps: a vessel's signal can vanish from thin coverage or a switched-off transponder, and only a repeating pattern is worth a second look.
• EXIF metadata: almost every social platform strips it on upload, so it is a lead, never a conclusion.

How is OSINT used in practice?

Real cases almost never look like a single spectacular find. They look like a chain of small, boring confirmations: this is the place, this is roughly the hour, this is the vessel, this is what the sky looked like. Each link is weak alone and strong in company.

That is why the examples below are written as techniques rather than stories. A story you can only admire; a technique you can run on tomorrow's material. Each one gives you a scenario, the method, and an honest note on what the technique cannot do, because knowing the limit is what separates an analyst from someone with a hunch.

Open the map →

Example 1: geolocating a photo from signs, shadows and skyline

Scenario. An image circulates showing flooded streets in a coastal town. No caption, no location, no context.

Method. Ignore the drama and inventory the fixed features: the language and typography on road signs, the shape (not the number) of a licence plate, the design of utility poles, roof materials, the silhouette of a ridge line or a tower on the horizon, the width of the pavement. Each one narrows the candidate region. Then you turn observation into a hypothesis ("a Mediterranean town with this ridge to the north-east") and test it against satellite imagery and street-level views until the buildings line up angle for angle.

Honest limit. Confirmation needs at least two independent matching features, not one. A single similar-looking corner is a coincidence generator. The full workflow, with the order that saves the most time, is in how to geolocate a photo.

Example 2: chronolocation, or dating an image by its shadows

Scenario. Two photographs are presented as the same afternoon. One of them is lying.

Method. Shadows are a clock. Their direction tells you where the sun sits on the horizon; their length relative to the object that casts them tells you how high it is. Combine those two with the latitude you established in the geolocation step and you get a window of plausible times. Slower clues corroborate it: whether trees are in leaf, how far a building site has progressed, the snow line on a distant slope, a seasonal shop sign.

Honest limit. Shadows give a window, not a timestamp, and sun geometry repeats symmetrically around the solstice, so the same shadow fits two dates months apart. Chronolocation constrains; it rarely proves on its own.

Try it. Photograph the same lamppost at mid-morning and late afternoon, then look at the two shadows side by side. That single exercise teaches more than any explanation.

Open the map →

Example 3: verifying a viral video with public cameras nearby

Scenario. A clip claims a violent storm hit a city centre an hour ago, and it is spreading fast.

Method. Pull a clean frame, geolocate it, then open the live public cameras closest to that spot. If three cameras within a kilometre show dry roads and flat light, the claim is either wrong or the footage is old. Cameras are unusually good witnesses because they timestamp themselves, they are pointed at fixed scenes, and nobody curated them for your benefit.

Honest limit. Camera coverage is uneven, and the absence of a camera proves nothing. A negative result here weakens a claim; it does not close it. The complete process, including how to hunt for earlier copies of a clip, is in how to verify a viral video.

Example 4: cross-checking a sighting against live ADS-B traffic

Scenario. A post says a military aircraft has been circling a town for the last half hour, with a blurry photo attached.

Method. Open the live flight layer over that area and read the behaviour, not just the label: a tight orbit at moderate altitude is a survey, training or patrol pattern; a straight high-altitude line is somebody going somewhere else entirely. Note the callsign, the type and the track shape, then compare the aircraft's silhouette in the photo with the type shown on the map. Two independent confirmations, one visual and one from the transponder signal.

Honest limit. Not every aircraft broadcasts a position, and some feeds are filtered. Absence from a flight map is not evidence that nothing flew.

Example 5: following a ship on AIS and reading the gaps

Scenario. A cargo vessel's track vanishes for several hours off a busy coast and reappears further along.

Method. AIS is self-reported and picked up by receivers, so a gap has two very different families of cause. The mundane one: nobody was listening, coverage thins dramatically away from populated coasts. The interesting one: the transponder was switched off, or the reported position does not match the physics of the track. What makes a gap worth a second look is the combination, it happens inside dense receiver coverage, it repeats in the same waters, and the vessel reappears with a jump that no plausible speed explains.

Honest limit. One gap is weather, one gap is a bad receiver day, one gap is nothing. A pattern of gaps is a question worth asking.

Try it. Follow a ferry across a busy strait for one full rotation. You will learn to read speed, heading and berthing before you ever look at anything ambiguous.

Example 6: reading metadata, and being honest about its limits

Scenario. Someone sends you a photograph and asks whether the file itself can settle the argument.

Method. If (and only if) you have the original file, EXIF metadata may carry the camera model, a timestamp from the device clock and occasionally GPS coordinates. That is a genuine head start: it gives you a hypothesis to test with the visual techniques above.

Honest limit, and it is a big one. Almost every social platform strips metadata on upload, so the copy you downloaded from a feed will usually have nothing. Device clocks are frequently wrong or set to the wrong timezone. And EXIF is trivially editable by anyone with a free utility. Metadata is a lead. It is never, on its own, a conclusion, and a workflow that depends on it will fail on the first serious case.

Example 7: monitoring a live event with public webcams

Scenario. A storm is due to make landfall tonight, or a port is expecting an unusual arrival tomorrow.

Method. Build a small board: four to six public cameras around the area, chosen so they face different directions. What matters is not any single frame but the change across frames, the sea state at nine and at eleven, the queue at the gate before and after. Save screenshots with the visible timestamp in shot; that is your evidence trail, and it costs nothing.

Honest limit. Cameras go down, and refresh rates vary from seconds to many minutes. Read the timestamp before you read the image. When several cameras on the same network drop simultaneously, that is usually a power or connectivity event, which is itself a data point.

Example 8: mapping infrastructure with open data

Scenario. You need to understand what physically exists around a site before you believe anything claimed about it.

Method. Layer the open datasets: ports, airports, power stations, plus collaborative cartography for roads and buildings. The value is plausibility testing. Is there a berth long enough for the vessel in the photo? Is that runway long enough for the aircraft type someone claims landed? Is there a substation where a report says the outage started? These questions kill bad claims quickly and cheaply.

Honest limit. Open infrastructure data has gaps and stale entries. Use it as a first map of the terrain, not as a land registry.

The eight OSINT examples at a glance

Read the right-hand column twice. Every one of these open source intelligence examples produces a bounded claim, and bounded claims are what stand up when someone pushes back.

The ethics are part of the technique, not an appendix

Every technique on this page investigates places, objects and events. None of them is aimed at a private individual, and that is deliberate. Public cameras show wide shots of streets, not faces; flight and ship signals identify craft, not passengers; geolocation places a scene, not a person.

The line is simple and worth memorising: that a piece of information is accessible does not make spreading it harmless. Do not compile data on private people. Do not publish an identification you cannot fully defend, a wrong one causes real harm and no correction undoes it. When in doubt, do not publish. The full framework, including the legal nuances of working with open sources, is in OSINT, legality and ethics.

Build your own practice board

Pick one technique and run it this week on material with a known answer: your own photo, a ferry you can watch from a webcam, a flight you can see leave. Grade yourself. Then chain two techniques together, which is where the discipline actually starts.

Several of the layers these OSINT use cases need sit in one place: open the live map, where public cameras, live flights, ship traffic and infrastructure share a single view, free and without an account. Point it at a port or an airport, ask one question you could answer with what is on screen, and answer it. If you want a structured route through the first weeks, how to get started with OSINT lays out the order.

What counts as an OSINT example, beyond this list

An OSINT example is any case where a question gets answered using information that is already public, without hacking, paying for private data or asking anyone for access. The eight cases above all come from the same family (open cameras, live traffic feeds, public imagery), because that is what a live map is built for. But the term covers more ground, and knowing the other branches helps you judge whether a technique you're reading about elsewhere actually qualifies.

The main branches, in practice, look like this:

The first two branches are exactly what Examples 1 through 5 cover. Examples 6 through 8 dip into documents and infrastructure. What the list doesn't touch is corporate and social OSINT, and that's on purpose: those need a different toolkit (registries, archive searches, username correlation) rather than a live map, and mixing them into a camera-and-flight-tracking walkthrough would dilute both.

If you're building a practice routine, treat these as separate muscles. Geolocation and chronolocation train your eye for physical detail. Corporate and social OSINT train your patience for paper trails. A solid investigator ends up needing both, but they rarely improve at the same rate, so don't judge your progress in one branch by how fast you're getting at another.

For the free tooling that supports most of these branches at once, see free OSINT tools. For the geolocation branch specifically, how to geolocate a photo goes deeper than Example 1 above.