Social Media OSINT by Platform: A Practical Investigation Guide

Social media platforms spill a ton of open-source data on people, groups, and events. Users freely share their location, relationships, opinions, and activities in real-time. They tag photos with metadata, check in at venues, and connect accounts in ways that reveal more than they probably intend.

Each platform exposes data differently, and has its own search quirks and investigation techniques. You need to know these differences to tailor your approach.

Before diving into platform-specific techniques, a few universal principles apply. Cache and archive everything. Social media content can vanish at any moment. Accounts get deleted, posts removed, profiles locked. Use yt-dlp for videos, SingleFile for pages, and archive.org's Save Page Now for URLs. This way, you have a copy of the data, even if it disappears from the platform.

Check multiple platforms for the same person. People often reuse usernames, photos, and biographical details. A username on Twitter might also appear on GitHub, Reddit, Instagram, Flickr, DeviantArt. Tools like WhatsMyName and Maigret automate cross-platform username checks.

Google dorking surfaces indexed social media content. Using site:twitter.com "target name" or site:instagram.com "username" returns indexed posts and profiles. This includes content that might not appear in the platform's native search, and is particularly useful for finding deleted content that Google cached before removal.

Profile photos are valuable. Reverse image search every profile photo through Yandex, Google, and FaceCheck.ID. People often reuse photos across platforms and profiles. This helps identify connections between accounts.

Let's take a closer look at each platform.

Twitter / X

Twitter is well-suited for OSINT due to its default public setting and accessible API. People freely share real-time updates, with location data and timestamps indexed, and connections between users mapped.

Basic search operators can be used to gather information. The from:username operator fetches every post from a specific account. The near:"city" within:15mi operator geolocates posts within a 15-mile radius. Google dorking can be used to uncover indexed tweets. The Wayback Machine can serve up archived Twitter profiles.

For more advanced searching, tools like Tweetdeck, Twint, and Social Bearing can be used. Tweetdeck allows for multi-column monitoring. Twint and Social Bearing analyze tweets and map posting patterns. Sleeping Time estimates an account's sleep schedule based on posting frequency, which helps infer time zones. Tools and databases, Twint, Social Bearing, Sleeping Time.

If you don't have a username, you can try reverse image searching the profile photo. You can also Google the full name with "twitter". Connected accounts can also help identify a user. Twitter allows third-party apps to access profiles, and some apps list users publicly, including Followerwonk, Twellow, and Tweepi, Followerwonk, Twellow, Tweepi.

Instagram

Instagram is a goldmine for investigators due to its visual nature. Photos carry location data, and backgrounds often reveal location and relationship details. Tagged photos and spots are usually public.

To investigate on Instagram, try searching by location tags to gather every public post from a specific spot. You can also use hashtag search to find public posts with a certain hashtag, without needing to follow the account. Additionally, Google dorking can be used to pull up profile pages and tagged pictures that are indexed. Tagged photos can expose individuals who keep their own feed private but appear in others' public snaps.

Several tools are available to browse public content incognito, including Imginn, Picuki, and StoriesDown. Osintgram provides more in-depth information, pulling metadata, followers, and following lists from public accounts. Maintain tight OPSEC.

Facebook

Facebook collects a large amount of personal data. Following the Cambridge Analytica incident, the company imposed severe restrictions on what third-parties could access.

Investigators can still find many OSINT opportunities. Public content and careful use of Facebook's built-in search tools can yield valuable intel. Facebook's native search can be used to find people by location and employer. URL manipulation can be used to access profiles via their numeric ID. Facebook Marketplace can be mined for location data, photos with identifiable background details, and seller profiles.

Several tools are available to help dig through Facebook's public index, including Sowdust, FB-Search, and IntelligenceX. Old-school search tricks still work, such as using site:facebook.com "target name" "city" to surface indexed profiles.

Be mindful of OPSEC. Facebook's restrictions have increased. You do not want to blow your cover.

LinkedIn

LinkedIn has the best professional background data, including employment history, education, skills, connections, and endorsements. You can see how people are connected.

Company pages list employee headcount and org structure. Groups show professional affiliations.

To find people, use LinkedIn's people search, which allows you to filter by company, location, school, and title. Company pages show current and past employees, company size, and recent activity. Alumni search maps networks for specific schools.

You can guess LinkedIn profile URLs, such as linkedin.com/in/username. You can also use Google to find indexed profiles. Be careful, as LinkedIn logs profile views. Use Privacy Mode before checking profiles you don't want to notify. Operators may miss things.

TikTok

TikTok shines in investigations involving younger crowds and viral content. Public accounts lay it all out, with videos, comment sections, and follower counts readily available.

Investigators can dig into the comment section to find location hints, personal details, and connections. Searching TikTok by keyword or hashtag can help track accounts discussing specific topics, events, or places. Additionally, Google dorking can turn up indexed content.

Several tools are available to help analyze TikTok data, such as exolyt.com, SnapTik, and SSSTikTok, which provide insights into posting patterns and video downloads. These tools are often overlooked by operators.

Telegram

Telegram's where you go for information ops, open-source intel, conflict docs, and organized crime chatter. Public channels are out in the open; anyone can search by name or dig through content.

Start with Telegram's built-in search to find channels and messages. You can also use tools like TGStat and Telemetr to monitor channel growth, message frequency, and connected channels. Services like IntelX can index Telegram conversations. For a quick look at any public channel, just use t.me/s/channelname.

Reddit

Reddit users aren't fully anonymous. Their activity history tells a story. Every comment, post, vote, and community join leaves a trace.

Searching Reddit directly works for recent posts and comments. Google is also useful; it can pull up indexed content that's slipped through Reddit's cracks. For deeper dives, services like Pushshift and Arctic Shift archive Reddit's history.

Analyzing a user's history can reveal a lot. Location, job, relationships, and beliefs often surface. Even karma ratios offer clues. A high comment-to-post ratio suggests someone who engages more than they create. The subreddits they participate in, such as r/teenagers, r/professionals, and r/seniors, narrow down demographics. Patterns emerge, and users leave trails.

Cross-Platform Tools

Searching for usernames across platforms can be a challenge. Tools like WhatsMyName, Maigret, and Social Analyzer help with that, scanning multiple sites at once.

Maltego does something different. It maps connections between social media accounts, domains, and other online identifiers. You see how they're linked. Maltego offers a range of features, including username and domain analysis, entity mapping, and data visualization.

Investigation Workflow

When investigating someone on social media, you usually start with a few basic pieces of information—a username, real name, phone number, email address, or a photo. Run that username through WhatsMyName or Maigret to see if it pops up on other platforms. Reverse image search those profile photos; you might find other accounts using the same pictures.

Next, map out the subject's network: who they follow, who interacts with them. Then, timeline their activity—look at posting patterns, location references, and key events.

Compare findings across platforms and look for inconsistencies. Save everything you find; this is your foundation for deeper analysis.

Operators miss details. Accounts get deleted.