Where do I begin?

What information do you have, and what steps can you take next?

Name
Username
Email address
Social account
Photo
Video
Post
Website
Phone number
Address
Hover over an item on the left to see information

Name

  • Run searches for the name. Include variations e.g. Bob, Bobby, Robert.
  • Try using people search services to get more details.
  • Search for the name combined with popular email domains.

Username

  • Try searching for other online accounts with the same—or similar—username.
  • Try services that check for uses of the same username across multiple platforms.
  • Search for the username combined with popular email domains.

Email Address

  • Run searches for the email address.
  • Run searches for the name or username before the @.

Social Account

  • Check About/profile/Bio sections for contact details or links to other accounts, blog or website.
  • Look through posts/photos to establish evidence of location, job, school etc.
  • Check older posts for inconsistencies or anomalies that may indicate the account has been compromised or changed hands.
  • Check the person's contact networks—followers, friends, subscribers on their account, and people liking, commenting and sharing their content.

Photo

  • Reverse image search. As well as the full image, try cropping and searching for elements within it.
  • Text search—keywords that may bring up previous versions or posts mentioning incident.
  • Check for EXIF data. Be wary - metadata can easily be faked.
  • Examine image for inconsistencies, repeating patterns. Consider forensic checks—but be wary of false positives.

Video

  • Run searches for the caption and description of the video.
  • Run keyword searches for the incident, apparent location and objects in the video.
  • Try to ascertain the location and time/date using maps and map tools.
  • Reverse image search still frames from the video. Use tools to extract thumbnails; if this brings up nothing, try using screengrabs of distinctive stills that a user may have chosen as a custom thumbnail.

Post

  • First things first: archive the post - downloading attached media if necessary.
  • Examine text for unique phrases or patterns.
  • Search keywords, hashtags and phrases to see whether the same post has been published elsewhere—a possible sign of coordinated or inauthentic activity.
  • Analyse the person posting, via their name and username.
  • Check posting timestamps and frequency
  • Look for location tags or references
  • Check the person's contact networks.

Website

  • Run searches for the name—it may already be well known as a source of inauthentic information. Include searches of social media platforms.
  • Search using phrases and keywords for the same content appearing elsewhere.
  • Try using Whois to find domain registration information. This will often be incomplete or protected using a privacy service.
  • Use website analysis tools to look for linked websites through elements such as shared analytics codes.
  • Reverse search images used on the website to see if they exist elsewhere online.
  • Look at the page source code or use the inspect panel to check for clues such as images hosted on different domains or having alt text that gives away connections to other websites.

Phone Number

  • Check the area code to get an indication of country, region or city. A simple web search or Wikipedia can help.
  • Use people search services to get more details.
  • Use the reverse number search function of phone directory sites

Address

  • Run searches. Use variations e.g. "St" vs "Street".
  • Check people search services. Note that not all include reverse address search. Some phone directories do have this function.