15 OSINT Tools Every Investigator Should Actually Open — In Order

Installing more OSINT tools rarely fixes an investigation. Opening the right tool at the wrong stage can still waste an afternoon.

The mistake I see most often is starting with the largest possible sweep. Someone has a username, so they run three username enumerators. Someone has a domain, so they open Shodan before checking the site itself. Someone has a photo, so they upload it to every reverse-image engine and treat zero results as a dead end.

The useful unit is not a list of tools. It is an order of operations. Each stage should either answer the question cheaply or produce a better input for the next stage.

The order matters more than the list

My default workflow has six stages:

1. Preserve the source and define the claim.
2. Read what is still inside the file.
3. Check whether the artifact has already been published.
4. Read the visible evidence when matching fails.
5. Pivot into usernames, emails, domains, and infrastructure.
6. Preserve the chain of evidence.

The stages are deliberately asymmetric. A photo may stop at stage four. A domain investigation may begin at stage five. Maltego is useful only after you have enough entities to graph. Hunchly is useful before you think you need it.

Stage 0: preserve before searching

Before opening a tool, write down the claim you are trying to support. “This looks like Lisbon” is not the same claim as “this image was captured on Rua da Conceição.” The second claim requires street-level evidence and a much stronger chain.

Save the original file, record where it came from, hash it if the case matters, and work on a copy. Publicly reachable data is not automatically appropriate to publish. Decide who will review the conclusion before you collect a pile of screenshots no one else can audit.

Stage 1: ask the file first

1. ExifTool should get the first turn for images and media files. If GPS survived, you have file evidence rather than an inference. Camera model, capture time, editing software, and embedded thumbnails can also explain how the file moved.

Where it stops: screenshots never had camera GPS, and most social platforms strip metadata. “No EXIF” is not evidence that a photo is fake or untraceable. It only closes one lane.

I also use a small offline parser for batch triage when I only need to know which JPEG or PNG files still carry coordinates. The important property is local execution: the source image should not leave the machine just to answer a metadata question.

Stage 2: check whether it already exists

2. Google Lens, 3. TinEye, and 4. Yandex Images overlap, but they do not answer the same question.

Lens is strong on objects, text, and visually similar scenes. TinEye is better for exact copies, edits, and publication history. Yandex can surface regional matches the others miss. A useful reverse-search pass checks all three, changes the crop, and searches both the full frame and distinctive details.

Where they lie: a zero-result screen feels final. It is not. It says the engine did not find a match in its index. It says nothing about whether the image is genuine, new, private, cropped, or simply poorly indexed.

Operational note: every upload gives a third party the image. That may be acceptable for a public-domain case and unacceptable for source material.

Stage 3: read the frame

5. Visual-clue geolocation begins where reverse search ends. Instead of matching a copy, it works from what is visible: script and signage, road markings, traffic direction, plate shape, architecture, terrain, vegetation, utilities, weather, and shadows.

This stage is slower because every clue must be separated into observation and inference. “The curb is painted black and white” is an observation. “This is probably Singapore” is an inference. Mixing them makes a confident story easy to write and hard to falsify.

The practical rule is three independent anchors. A transit logo, a language fragment, and a road design can support each other. Three details all derived from one sign do not.

When metadata is gone and the image was never indexed, I use a photo location finder that shows its reasoning as a candidate generator, then verify the suggested place independently. The clue list matters more than the pin.

Where this stage stops: generic interiors, plain forests, heavy filters, night shots, and frames without readable text or infrastructure. “Not enough evidence” is a valid result.

Stage 4: pivot from the surrounding identity

If the case contains a username or email, the next five tools earn their turn.

6. Sherlock is a fast username sweep. 7. Maigret goes wider. 8. WhatsMyName is useful when signal quality matters more than coverage. 9. Holehe checks whether an email is registered with supported services. 10. Have I Been Pwned gives breach exposure context.

Treat every username hit as a lead, not a finding. A site returning HTTP 200 does not prove the account belongs to the target. Open the page, compare profile details, dates, avatars, writing style, and linked identities.

This is also the stage most likely to expose the investigation. Username and email tools may query live services. Some services log requests, rate-limit them, or notify account holders.

Stage 5: infrastructure only when infrastructure exists

11. theHarvester collects public emails, subdomains, and hosts. 12. Shodan indexes exposed services. 13. Censys is strong for certificates and asset pivots.

These tools are excellent when the case includes a company, domain, IP address, or certificate. They are theater when the only input is a street photo. Do not create an infrastructure stage just because the tools are familiar.

Where they lie: large result sets look like progress. Most of the work is still entity resolution, scope checking, and eliminating stale infrastructure.

Stage 6: hold the case together

14. Maltego CE becomes valuable when relationships no longer fit in a few browser tabs. Use it to represent entities and provenance, not to make weak connections look authoritative.

15. Hunchly captures and timestamps pages during research. That makes it the least glamorous tool on this list and one of the most important. Pages change. Accounts disappear. A conclusion that cannot be reconstructed later is a note, not evidence.

A compact comparison

Tool	Best input	What it returns	Common failure
ExifTool	Original file	Metadata and GPS	Nothing after stripping
Google Lens	Image or crop	Similar objects and pages	Visually similar wrong match
TinEye	Published image	Copies and edits	New or unindexed image
Yandex Images	Image or crop	Regional visual matches	Uneven regional coverage
Visual-clue geolocation	Unindexed photo	Ranked place candidates	Thin evidence looks precise
Sherlock	Username	Candidate profiles	HTTP false positives
Maigret	Username	Wider candidate set	More noise
WhatsMyName	Username	Curated service checks	Narrower coverage
Holehe	Email	Registration signals	Rate limits and live queries
HIBP	Email	Known breach exposure	Triage, not attribution
theHarvester	Domain	Hosts, emails, subdomains	Noisy and stale data
Shodan	IP or domain	Internet-exposed services	Not a people or image tool
Censys	Certificate or asset	Infrastructure pivots	Scope confusion
Maltego CE	Resolved entities	Relationship graph	Graphs amplify bad inputs
Hunchly	Browsing session	Captured evidence trail	It preserves; it does not find

Three habits that keep the result defensible

First, write observations before interpretations. If you cannot quote the raw clue without naming a place, you probably wrote an inference.

Second, attempt falsification. Take the leading candidate and look for something that should be present but is not. A candidate that survives an attempt to break it is stronger than one you only tried to confirm.

Third, record the tool and version. Search indexes, models, and datasets change. “Google found it” is not reproducible enough for an editor, incident review, or court filing.

FAQ

Are free OSINT tools enough?

Usually, if the workflow is narrow. Paid products buy coverage, speed, collaboration, or proprietary datasets. They do not remove the need to verify identity and provenance.

How accurate are AI geolocation tools?

There is no useful global number. Accuracy depends on the dataset, geography, image quality, and whether the claim is country-, city-, or street-level. Ask what the number was measured on and treat every candidate as a hypothesis.

Do OSINT tools alert the target?

Some can. Passive archives and local metadata tools generally do not. Username sweeps, email-registration checks, and anything touching the target's infrastructure may appear in logs or trigger controls.

The toolkit is the easy part. The difficult part is knowing which question each tool can answer, when it has earned its turn, and what evidence would prove your favorite candidate wrong.

Disclosure: I work on the image-geolocation tool linked above. The other tools are included because they occupy different stages of the workflow; there are no affiliate links.