Instaloader: Instagram Content and Metadata Collection for OSINT

Instagram is a pain for investigators. Content vanishes, and metadata is hidden. Saving stuff via screenshots loses most of the useful info. Instaloader fixes the first two issues directly. For the third, the disappearing content problem, it provides a solid solution, which is why it's valuable in social media OSINT.

Instaloader grabs more than just media files. The easy part is grabbing the files. What's valuable is what comes with it: posts, stories, comments. Dates, locations, user interactions are preserved too.

Manual archiving via screenshots can't compete. You lose context, engagement data, and often the media itself. Instaloader keeps it all.

It works quietly in the background. There is no need to manually save each post. It handles the heavy lifting, letting you focus on analysis.

Instaloader is a time-saver. You get a complete picture of an account or hashtag. Its strength in OSINT workflows is efficiency. Operators appreciate the efficiency.

What Instaloader Collects

Instaloader gathers photos, videos, stories, reels, IGTV content from public Instagram profiles. Original media files keep their filenames, timestamps.

Metadata is crucial for investigations. For each post downloaded, Instaloader saves a JSON file with details like the caption at download time, hashtags, UTC timestamp. The JSON file also includes location tags, accounts tagged, like and comment counts, post URL, and Instagram's internal post ID. All information is structured, easy to read, and stored locally.

Instaloader collects more than just feed content. It gathers follower and followee lists, post comments, and posts where the account's been tagged. This allows you to map social connections and not just save content.

Metadata as Intelligence: What the JSON Sidecars Contain

JSON sidecars make Instaloader a better choice than screenshot archiving. When an Instagram post is deleted by the user or due to account deactivation, the media file and all associated data vanish: caption text, location, tagged accounts, and timestamp. A screenshot saves the visual; Instaloader preserves the structured metadata.

Instaloader's sidecars include precise timestamps. This data reconstructs a posting history, enabling analysis of an account's activity patterns. You can identify peak activity times, time zones, and behavioral changes. Even after posts are deleted, caption text allows for linguistic analysis and keyword tracking, such as analyzing posts for specific words or phrases.

Instaloader preserves location metadata. Instagram location tags link to specific venues with coordinates. A subject who consistently tags their location creates a movement pattern that's hard to spot visually. By cross-referencing these coordinates with a mapping tool, you can map a subject's public presence history.

Instaloader also exports follower and followee lists as structured account lists. Comparing follower lists from multiple related accounts reveals mutual connections - accounts that follow both subjects. This analysis can uncover connections that aren't immediately apparent. Account creation dates and engagement patterns in these lists help identify potential coordinated inauthentic behavior. That's it.

Core Commands and Usage Patterns

The baseline command downloads everything:

instaloader <username>

The command creates a local directory named after the username, containing all posts, profile metadata, and profile picture downloaded. Stories, tagged posts, and follower lists are not included by default; specific flags are required for those.

The flags that matter for investigation use:

• --no-pictures — downloads JSON sidecar metadata without media files. Use this when the investigation needs timing and caption data and bandwidth or storage is a concern. Significantly faster than full media downloads.
• --stories — includes the story archive where available
• --tagged — adds posts in which the account has been tagged by others
• --followers and --followees — exports the account's follower and followee lists to text files
• --comments — downloads comment data for each post

Hashtag collection works with a quoted hashtag argument. You'd list hashtags like "#AI", "#MachineLearning", "#DeepLearning". Simple strings. No extra syntax.

instaloader '#hashtag'

Downloading a hashtag's post feed serves a few key purposes. It lets you collect event-based data. You can monitor coordinated campaigns around a specific tag. It also helps you archive public conversations on a topic before they disappear or get deleted.

Authentication, Rate Limits, and Operational Considerations

Unauthenticated collection works for public accounts, but it hits Instagram's strictest rate limits. Large profiles, with thousands of posts, will max out requests mid-collection. That's when temporary pauses or blocks kick in. It's Instagram's anti-automation measure, not an Instaloader issue.

Logged-in collection changes this. Cookie-based authentication boosts rate limits. It also unlocks follower and followee lists. Instagram restricts those to logged-in users. Load session cookies from a browser using --load-cookies. The session must be from an Instagram logged-in account. A separate account for collection is recommended. If that account gets blocked, your personal account keeps working.

Two flags help with rate limiting:

• --sleep-requests — adds a delay between requests (seconds); set to 1–2 for routine collection, higher for large downloads
• --max-connection-attempts — controls retry behavior on failed requests

When downloading a large profile quickly, time is crucial. Start collecting data early. Authenticate your requests. Use moderate sleep intervals to avoid overloading the system.

Without authentication, your IP will get blocked within minutes if you're pulling from an account with many posts. This happens fast. Add authentication, throttle your requests, and you'll get the data eventually - just don't expect it to be fast.

OSINT Investigation Workflows

When an Instagram profile goes into investigation, the first move is to download the entire profile. Right away. No analysis, no review, just download. The reason is simple: Instagram content has a habit of vanishing. Accounts get deactivated. Posts disappear.

Instaloader's local archive becomes your evidence copy. This is what you'll rely on for the investigation.

Reconstructing the timeline from a full profile download relies on the JSON sidecar timestamps. Sort posts by UTC timestamp. Look at location tags. Note any changes in posting frequency or content type. This builds a chronological picture of the account's history, stuff you can't see on the Instagram UI.

A subject's posting patterns can reveal a lot. For example, someone posting from one city for three years, then suddenly shifting their pattern six months ago, will show up in the sidecar data. You wouldn't catch that just scrolling through the profile manually.

Mapping a network across related accounts takes some work. Download follower and followee lists from the main subject account using --followers and --followees. Identify interesting accounts in those lists. Download their lists too. Cross-reference to find mutual connections – accounts in both follower lists that aren't obvious from the public view.

This approach uncovers connections between accounts that aren't visible on the platform. It is systematic. It works. Accounts get linked that wouldn't show up otherwise.

Limitations and Legal Considerations

Instagram's rules say no scraping. Using Instaloader violates those terms. For investigations — such as journalism, research, and police work — the legal and practical implications vary. You need to understand those nuances before collecting data at scale, especially if you plan to use that data in court.

Private profiles are off-limits. Instaloader can't bypass Instagram's privacy settings. If a profile is private, you won't get any content unless you're an approved follower. This is not a limitation of Instaloader; it's Instagram working as intended.

Instagram changes things. They update their API and anti-automation tools all the time. Instaloader breaks sometimes. The project releases updates to fix it. Before collecting data, check GitHub for recent issues and update to the latest release. Don't risk using an outdated version if accuracy matters.

Verdict

Instaloader leads in free Instagram metadata collection. It provides JSON sidecar data per post, follower and followee lists, and a full profile archive with timestamps. These features are not available elsewhere for free.

Instaloader excels in archival use cases. It captures a subject's entire public posting history — with metadata — before they delete content or deactivate their account. No manual method matches this. Screenshots can't capture UTC-timestamped posts, location tag coordinates, tagged accounts, or produce analysis-ready data. Instaloader does this automatically.

Rate limits and Terms of Service exposure are real concerns. Manage them actively. Run Instaloader with throttling flags. Use a dedicated collection account. Know the legal context before using collected data in formal proceedings. With these practices in place, Instaloader is a reliable, high-value tool for Instagram OSINT.

Best for OSINT investigators archiving Instagram profiles and metadata before deletion, analysts building social graph intelligence from follower relationships, journalists preserving public account records. Documentation is available at instaloader.github.io and GitHub at instaloader/instaloader.