Effective digital investigative research relies heavily on gathering small pieces of information on a person or group and combining those to build a more comprehensive picture. Being able to find things like email addresses, usernames and sites with which they have accounts helps build out a profile that can be used for further investigation.
Finding email addresses
Hunter.io
Finding email addresses for people or organizations you’re researching is a core building block of online research. The problem is you can’t just fire off emails and see what bounces back — not just because it’s inefficient but also because you probably don’t really want to alert the focus of your research that you’re looking for something. There is a better way with Hunter.io, the go-to tool for finding email addresses. The online service (free for up to 100 searches) makes it easy to find email addresses associated with a domain. Searching for microsoft.com, for example, will return thousands of email addresses associated with that domain as well as links to the various sources for each email address.
Hunter.io also offers services to bulk search for email addresses based on a list of names as well as an email verifier which will test email addresses to see if they are operational. There is also a Chrome extension that offers quick access to most of the services Hunter.io offers.
Finding usernames
Another useful research technique is to search for usernames to see what connections surface. You may, for example, know that a user has a specific username on one site. Doing a username search can, and often does, find other websites and online services that are connected to the same user. And even if you don’t have a specific username, trying various combinations can also prove fruitful.
UserSherlock
User Sherlock is one of many services that will search for usernames across multiple sites. Doing a search on User Sherlock returns results for more than 20 popular online sites and services with links to accounts found with the given username.
If you want to take it a step further, IntelTechniques offers a similar servicethat searches not only User Sherlock but nearly 20 other similar sites. IntelTechniques’ username search is essentially a search of all the other searchers, which can throw up a large number of unexpected results.
Unraveling the web
Many of the investigative tools in use today are single-type tools: finding phone numbers, email addresses, usernames and so on. But there is a growing category of tools that are designed to scour dozens or even hundreds of different sources simultaneously, which can significantly reduce the original discovery period in any project. One of the most popular tools for this is IntelTechniques. It wraps dozens of popular sources into a single search tool. One of the newest of these, and the one that has a lot of OSINT (open source intelligence) people excited, is Spiderfoot.
Mapping the web
Spiderfoot is an open source tool written in Python that can be used to query more than 100 public data sources simultaneously. The tool is modular so the various sources queried can be turned off and on as needed. The results can then be visualized for better analysis. Spiderfoot is a little more technical than most of the other tools on this list and it needs to be downloaded and installed on your computer. The documentation is comprehensive and explains how Spiderfoot can be installed on most platforms. Although the documentation specifically mentions the Windows and Linux platform, I have it installed and running on MacOS, as well. Spiderfoot can be a little daunting at first but a little time spent learning how to set it up properly will be well worth the time.
Protecting yourself
If there is one thing that doing online research makes us realize is that it’s not only other people’s information that is easy to find online but our own as well. Doing some research on your own name and other personal details using some of the tools above will show you how much information is out there about you. There’s not a lot you can do in today’s hyperconnected world to keep your information completely private but there is one thing that you can do to make your life a little more secure: a password manager.
Earlier this month another major database of hacked details was released (more than 700 million records) which means that most of us are already potentially exposed to hackers. But keeping your passwords updated and making them sufficiently complex is difficult without the use of a password manager.
There are many password managers available including LastPass, DashLane and the open source KeePass, and they all work mostly the same. The idea is that you store all your passwords in a central repository that you then secure with a single master password. This has many advantages over trying to remember all your passwords or writing them down somewhere. One of these is that you can create very unique, long and difficult-to-guess password for each of your accounts. You don’t need to remember them so they can literally be tens of characters long. If you use an extension for your browser, or an app on your phone, then your password manager will automatically fill in your password details when you visit known sites.
Of course, the risk here is that you forget your master password. If you do, you may be locked out of your password store forever as all good password providers make sure that all master passwords are encrypted and that they are never stored in plain text. But as long as you store a copy of your master password somewhere safe (i.e., not on your desktop) you should be fine, and the convenience of having all your passwords stored in a single secure vault is worth the time spent on setting it up.
This post was originally published by the Global Investigative Journalism Network. It was republished on IJNet with permission.
Alastair Otter is GIJN’s IT Coordinator. He has worked on numerous data journalism projects in South Africa and specializes in programming interactive data visualizations.
Main image CC-licensed by Unsplash via Barn Images.