Video Investigation and OSINT: How to Analyze, Geolocate, and Verify Video Evidence

Video is the preferred format for documenting conflict zones, civil unrest, and human rights situations. Verifying video evidence - where, when, and what's shown - relies on a set of investigative techniques and open source tools.

Investigators use these techniques to answer key questions. Geolocation involves matching terrain, architecture, and infrastructure to satellite imagery and maps to pinpoint the location where a video was filmed. Chronolocation involves establishing a filming date and time window using shadows, moon phase, vegetation, and event details. Verification involves checking for inconsistencies and corroborating evidence to spot manipulation, mislabeling, or misattribution. Subject identification involves identifying individuals, vehicles, or organizations using visible details and OSINT sources. Contextual analysis involves analyzing what's present, absent, or happening in the frame.

Preservation is crucial. Video evidence vanishes fast, as platforms remove content and accounts get suspended. A go-to tool for downloading videos is yt-dlp. It downloads videos from YouTube, Twitter/X, Facebook, and more, using a URL and preserving the original metadata intact.

yt-dlp https://www.example.com/video

Hunchly captures web pages, video, timestamps, and source URLs. You can also use archive.org's Save Page Now, which takes a URL, saves the page and video, and makes a permanent public record.

The goal is the original video file, not a screenshot or a re-encoded copy. Originals have metadata, such as recording date and time, GPS coordinates, device make and model, and camera settings.

ExifTool retrieves this metadata from video files. To use it, run the tool on a downloaded video.

exiftool video.mp4

reveals GPS Latitude, GPS Longitude, Create Date, and Camera Make/Model. Metadata often disappears on social media uploads. Get the original file before uploading.

Geolocating a video means matching landmarks frame-by-frame. Identify fixed features like mountains, hills, road layouts, and buildings. Check OpenStreetMap or Google Maps to narrow down the location. Read signage, license plates. Street View helps.

Chronolocation establishes the filming date and time. Shadows follow physics. The Sun's position is calculable. Use SunCalc or ShadowCalc to test dates and times. Vegetation and seasonal indicators help. Verifiable events anchor the date.

Authenticity verification is critical. Claimed origin, date, and location may be false. Recycled, decontextualized, and manipulated footage are common.

Use InVID / WeVerify to search for earlier footage. Google Video Intelligence API and Yandex Image Search help. Check YouTube, TikTok, Twitter, and Telegram for earlier uploads. Deepfake detection uses Deepware Scanner and Microsoft's Video Authenticator.

Effective video OSINT uses various tools. InVID / WeVerify verifies. yt-dlp downloads videos. ExifTool extracts metadata. SunCalc analyzes shadows. Mapillary and Google Earth Pro provide satellite imagery, which offers geographic clue identification.

The workflow includes preservation, downloading the video. Metadata extraction is done by running ExifTool. Geographic clue identification involves mountains and infrastructure. Location narrowing uses OpenStreetMap and Google Maps. Satellite imagery verification confirms the location. Chronolocation involves shadow analysis. Earlier version checking uses InVID and YouTube search. Documentation records coordinates and sources.

Learn more from Bellingcat's Online Investigation Toolkit. Read First Draft News verification guides and WITNESS Media Lab documentation standards.

Updated April 2026. See also: Hunchly Review, Reverse Image Search Guide, Geolocation Guide, What Is OSINT.

Read the InVID/WeVerify browser extension. Check WITNESS Media Lab and First Draft verification guide.