Start With a Question, Not a Tool

Whenever I onboard a new analyst, I watch for one specific habit: do they reach for a tool first, or do they ask a question? If you start with a tool, your investigation will balloon into an unmanageable mess within hours. The secret to staying sane is a narrow scope. Instead of saying, “Tell me everything about Company X,” ask, “Who actually controls the bank accounts for Company X?” One leads to a rabbit hole; the other leads to a result.

What OSINT Really Is (and Isn’t)

In the field, OSINT isn't just "googling things." It’s about provenance. In my workflow, if I can’t point to a lawful, accessible source and show exactly how I found it, it doesn't count. The discipline isn't in what you find, but in what you can prove. If I can't explain why a piece of data is relevant to the original question, I leave it out. Discipline is your best defense against data overload.

Boundaries: Your Safety Guardrails

Ethics and legal boundaries aren't just philosophical concepts-they are practical guardrails that stop you from poisoning a case. I set these rules early and document them. This way, if a client or reviewer asks why a dataset is limited, I have a clear, professional reason ready.

Even with public data, remember that aggregation creates risk. Connecting five "innocent" data points can create a sensitive profile. We keep our workspaces separated by sensitivity to ensure we don't get "burned" by our own collection.

Capturing Sources: Don't Trust the Internet to Stay Still

We all know the sources: registries, social profiles, archives. But the how is more important than the what. I record the specific claim, the date I saw it, and a pointer that will still work next week. A screenshot is a nice backup, but a URL and a timestamp are your primary evidence. If the page is unstable, archive it immediately.

Building Your First Entity Map

When you start mapping, begin with a single subject and add only what the evidence explicitly supports. Every line you draw between two people is a "claim," and every claim needs a source. If a relationship is just a "hunch," mark it clearly and keep it visually separate from the facts. Your map should read like a logical argument, not a messy brainstorming session.

The 'Over-Connection' Trap

The most common mistake for beginners? Drawing too many lines. A dense, tangled graph might look impressive to an outsider, but it’s useless for analysis because it hides the truth. I prefer a clean map with fewer, clearly labeled edges. If you aren't 100% sure what the relationship is yet, don't draw the line.

A Repeatable Workflow

My baseline workflow is intentionally "boring" because boring is reliable:

1. Define the specific question.
2. Collect sources with clear provenance.
3. Model the entities and links.
4. Validate the links that actually drive the conclusion.

If the case gets complex, I add a timeline view to make sure the sequence of events actually makes sense.

How Tracehunters Keeps You on Track

I don't use Tracehunters to replace my judgment; I use it to enforce my discipline. It keeps the map tidy and, more importantly, keeps the sources physically attached to the relationships. When the pressure is on and you need to switch to a timeline view to check a sequence, the tool makes sure you aren't rebuilding your analysis from scratch.

The Junior Analyst Checklist

If you’re coaching someone new, keep it simple. Ask them three things:

• "What is the specific question you are answering?"
• "Can you show me the source for every line on this map?"
• "Which parts of this are facts, and which are just your suspicions?"

If they can answer those, they’re already ahead of most researchers.