4.4 OSINT, Social Media & Digital Source Preservation

OSINT, Social Media & Digital Source Preservation

Open-source intelligence (OSINT) is disciplined research using information lawfully available from public or authorized sources. It is not a synonym for “anything reachable with a browser.”

Scope and authority

Begin with the question the client needs answered and the sources authorized for that purpose. Limit collection by person, issue, date, and platform. Recording every unrelated friend, child, political view, or medical disclosure increases privacy risk and makes the useful evidence harder to defend.

A public page can still contain copyrighted, sensitive, false, or misattributed material. Public visibility affects access; it does not eliminate purpose limits, professional confidentiality, or later-use rules.

Research environment

Use an environment that protects client and investigator data:

• a dedicated browser profile or managed research workstation;
• current security updates and multifactor authentication;
• approved storage rather than personal cloud accounts;
• a collection log;
• controlled download scanning; and
• accounts that truthfully identify their function when interaction is required.

A separate research profile can prevent accidental likes or personal-account exposure. It should not be used to impersonate a real person, officer, attorney, friend, or prospective romantic contact.

Search method

Develop seed identifiers and expand carefully:

1. verified names, usernames, domains, phone numbers, and email addresses;
2. exact-phrase and site-limited searches;
3. official business, licensing, court, and property sources;
4. archived public pages where lawful;
5. image metadata and reverse-image searches;
6. linked usernames and known associates; and
7. date, location, and event filters.

A username match is not an identity match. Corroborate with biography, photographs, dates, known relationships, domain ownership, linked accounts, or other independent facts.

Search snippets are incomplete and can be stale. Open the source, capture context, and record access time.

Access boundaries

Do not:

• guess or purchase passwords;
• use a client’s credentials without confirmed authority;
• evade technical access controls;
• send a deceptive friend or follow request to penetrate a private account;
• exploit a logged-in device or session;
• scrape in a way prohibited by law or an applicable enforceable restriction; or
• induce another person to disclose protected information unlawfully.

The Computer Fraud and Abuse Act and Tennessee computer statutes can apply to unauthorized access. The Stored Communications Act, contract terms, privacy law, and professional-conduct rules can also matter. A client cannot authorize access to somebody else’s account merely because the client knows the password or once shared the device.

If private content is relevant to litigation, use counsel and formal discovery rather than a fabricated persona.

Collection log

For each item preserve:

• exact URL or platform location;
• account name and unique identifier;
• date and time with time zone;
• collector;
• collection method and account state;
• full-page or surrounding context;
• original downloaded file where available;
• filename and metadata;
• a cryptographic hash when useful; and
• notes showing why the account is attributed to the subject.

A screenshot captures appearance, but it may omit comments, edit history, metadata, or the link behind a button. Pair screenshots with source files, page exports, screen recordings, or platform responses as appropriate.

Interpretation

Separate what the item depicts from what it proves. A photograph posted Tuesday may have been taken years earlier. A location tag may be user-entered. A shared article does not prove agreement. An account can be spoofed or compromised.

Geolocation uses visible landmarks, road patterns, signs, terrain, shadows, and corroborating maps. State confidence and alternatives. Reverse-image or facial-comparison results are leads, not identity conclusions. Human review and independent corroboration are essential.

Preservation and authentication

Preserve material promptly when loss is likely, but do not alter the source. Maintain an original and a working copy. A hash can show that a preserved file has not changed since hashing; it does not prove who created the file, when the depicted event occurred, or that the account belongs to the subject.

Under Tennessee Rule of Evidence 901, the proponent must offer evidence sufficient to support a finding that the exhibit is what the proponent claims. Authentication can come from a witness with knowledge, distinctive characteristics, platform records, metadata, or a documented collection process. The court evaluates the whole foundation.

Reporting

Use neutral statements:

• “The public profile using handle @example displayed the attached post at 14:32 Central on October 4, 2026.”
• “The account is attributed to the subject with moderate confidence based on the linked company website, matching business email, and photographs.”
• “The post states X; this investigation did not independently verify the underlying event.”

Avoid “the subject admitted” unless the attribution and meaning support that conclusion.

Exam method

Choose lawful public access, minimal relevant collection, identity corroboration, context, and reproducible preservation. Reject deceptive access, password use without authority, and claims that a screenshot or hash proves every aspect of authenticity.