How To Investigate A Person Of Interest In 2026

Target Relationship Entity Graph Visualization

In this article, I will share my personal methodology, techniques, and tools for mapping out the digital footprints of a person of interest.

Step 0: Define Your Target’s Context

When I approach a target, the first questions I ask revolve around their areas of interest and daily life:

• What does this person do for a living?
• Where do they live?
• What are their hobbies, website, profession, and social/professional networks?

Having clear answers to these questions helps me focus the investigation and avoid falling into rabbit holes.

Practical Example

Target: Precious Vincent
Interest: Cybersecurity / OSINT / Threat Intelligence
Location: Africa
Scope: Digital Footprint Analysis

Phase 1: Google Dorking

Once I know the target’s name and interests, my first step is to use advanced search operators on Google or Yandex. Using both platforms for data correlation and triangulation is essential — what is absent on one is often present on the other.

I navigate to either search engine and use operators like:

This focuses the search on the target and filters out unnecessary noise.

Next, I may reverse the search to find any name tags on forums, videos, news, or images. I also look back at older dates to see if the target posted useful information earlier than the current year of my investigation.

At this stage, remember: the larger the target’s digital footprint, the more intelligence you can collect. The smaller the footprint, the more likely a dead end. Keep this in mind at all times.

I then manually access each social media account discovered here and correlate their data with what I already have. If both sources share the same characteristics, I am on the right track and I continue pivoting.

Phase 1.1: Sherlock for Broader Footprinting

Different investigators prefer different tools, but aside from whatsmyname, my favorite username enumeration tool is Sherlock — it was love at first sight.

Here, I cast a wide net using Sherlock to find potential information on my target that might be useful. Manual analysis is always required to exclude noise and focus on meaningful data collection.

Phase 2: Target Email Address Lookup

An email address remains a critical asset in investigative, intelligence, and due diligence contexts. Because of widespread, consistent reuse across social media and digital platforms, a single email address often serves as an aggregator for an extensive digital footprint — a really goldmine for investigators.

If I haven’t located the target’s email on platforms like Facebook, X (Twitter), or LinkedIn, I use the permutation method (see the image below) to identify a possible way into the target email address.

The technique goes like:

Target: first & last name or using their nickname > combination of username variable to find potential match.

The email permutation method works by taking known identifiers of a target – first name, last name, middle name, nickname, or username – and combining them with a known organization domain (e.g., company.com) to generate dozens of potential email address combinations.

My Single Logic Flow: Generate Pattern > Verification > Identity Correlation > Final Verdict:

You can ask LLMs like ChatGPT to generate plausible email formats for a given target or company if you don’t want to use a dedicated permutator tool:

For OSINT prioritization, the most statistically common formats are usually:

1. firstname.lastname@gmail.com

2. firstnamelastname@gmail.com

3. firstinitiallastname@gmail.com

4. firstname.lastname + year/number

5. Known alias or handle reuse (e.g. d4rkintel)

Phase 2.1: contact-out/SignalHire And GitHub API Lookup

If the initial enumeration techniques fail to identify the target’s email address, I pivot to LinkedIn using contact-out/SignalHire on the target profile (reference: https://medium.com/@preciousvincentct/osint-at-home-the-footprint-f3a83484943c) or GitHub to uncover potential email exposure through public developer activity. This involves analysing the target repositories, commit metadata, profile information, issue discussions, and configuration files where email addresses are often unintentionally disclosed. I may conduct the investigation manually or leverage the GitHub API (image below) to extract commit-associated email artifacts at scale:

Contact-out = intelligence collection on a POI:

POI’s email collection via GitHub API lookup:

The API URL https://api.github.com/repos/[owner]/[repo]/commits is the standard GitHub REST API endpoint used to list and fetch the commit history of a specific repository.

What This API Call Returns

When you send a GET request to this URL, GitHub returns a JSON array of commit objects. For each commit, it provides:

• Git Author Metadata: Name, date, and the public email address of the person who wrote the code.
• Git Committer Metadata: Name, date, and the public email address of the person who applied the commit to the repository.
• GitHub Profile Links: The linked GitHub account usernames and profile data (if the email is linked to an active account).
• Commit Details: Unique SHA hash, commit message, and a URL pointing to the specific code changes.

Why It Is Used for Finding Emails

This specific endpoint is highly effective for finding target emails because:

• It exposes the actual email addresses embedded in the Git configuration files (git config user.email) of the contributors.
• It bypasses file content restrictions, allowing you to find emails even if they are not explicitly typed out inside the source code files.
• You can easily parse the JSON response using tools like jq or Python to extract every unique email address from the commit.author.email fields.

Most times, to improve efficiency and correlation accuracy, I also utilize tools such as Ghintel or Braingainsoft to automate GitHub intelligence gathering and identify email-linked indicators tied to the person of interest.

With just a few clicks, I can often identify the target’s GitHub-associated email address, (image below) providing an additional pivot point for further investigation and correlation:

Ghintel

Braingainsoft

Phase 2.2: Target Email Footprint Via Breach Scouting

If my initial approach have failed to yield useful results, another alternative search is via finding the POI’s email address, address, phone number, etc via breach scouting — i.e hunting for the POI leaked email addresses via historical breach logs, and credential text dumps across the web and known paste-repositories. This is achieved by customizing my dork queries to align with the POI’s digital footprint. For instance, if I noticed the POI have an active presence on LinkedIn, Facebook, or Twitter, etc I might customize my dork query to find potential intelligence if their data like email address, address, password have been exposed in related data breaches, and if luckily I found the missing piece, this becomes a factual lead for me to further lateral or horizontal movement.

My Logic Flow:

Phone Number → Breach Confirmation → Targeted Dorking → Intelligence Unification

• Utilize the target phone number (if I have any) to test for initial clue if their data have been exposed in Facebook data breach
• Customizing my dork query to find the exposed data if step A says YES
• Unifying everything into an intelligence package for lateral and horizontal movement

STEP A: POI Phone Number Analysis via Facebook Data Breach Checker

• Run the target phone number through Facebook breach datasets (2019 leak or equivalent) using breach-checking tools or local databases for initial intelligence

STEP B: Customizing My Dork to Align with Step A > Using the POI’s Social Media Platform

Leverage the POI’s active social media handles (LinkedIn, Facebook, Twitter, etc) to construct targeted search queries across paste repositories and public breach logs

Example Dork Queries:

site:com filetype:sql OR filetype:txt OR filetype:log "@Facebook.com" "password" OR "hash"

site:pastebin.com "Target Username"

(site:pastebin.com OR site:paste2.org OR site:pasteorg.com OR site:controlc.com) "Target Username"

"Target Phone Number" (email OR password OR hash OR passwd)

"Target Email" (password OR pwd OR hash OR credential)

(site:pastebin.com OR site:ghostbin.com OR site:psbdmp.ws) "Target Username" (sql OR log OR txt)

Execution Priority:

• Start with the recovered email from Step B (if available)
• If no email found, pivot to known usernames across platforms
• Filter results by recency (prioritize dumps from last 1–2 years for higher password relevance)

STEP C: Intelligence Collection

Target Username: John Doe

Email Address Found: johndoe@yahoo.com

Reverse Email Search Provided Additional Footprint:

• Twitter: @JohnDoe (active, follows industry-related accounts)
• LinkedIn: John Doe — [Job Title] at [Company] (confirmed employment)
• Locations: [City, State] (from breach metadata and social check-ins)
• Phone Numbers: [Secondary Number] recovered from additional breach logs
• Work Life: [Company Name], [Role], [Years Active] (corroborated across multiple sources)
• Password Recovery: Password hash recovered suggests pattern (e.g., [Name]+[Year]) for potential lateral testing
• Associated Accounts: GitHub, Medium, or other platforms linked via email search

Phase 2.3: Validation and the “Forgot Password” Technique

Before using an email address, the first crucial step is to validate its integrity. Once validated, I use the “Forgot Password” technique to map additional social media footprints. This technique is particularly powerful for uncovering additional intelligence.

Doing this manually takes a lot of time, so I use tools like Holehe to automate the process. Nevertheless, understanding the manual approach is essential — it remains the baseline for professionalism.

Once I get a positive sign, there is an 80% probability that I can pivot successfully using the extracted username from the email address across that platform.

Example:
vincentprecious867@gmail.com yields possible usernames variation:
vincentprecious867, vincentprecious, vincent precious

The “forgot password” technique in Open Source Intelligence (OSINT) is a passive reconnaissance method where investigators use the password recovery features on websites to reveal, validate, or enumerate partial personal information (PII) about a target. Instead of trying to break into an account, the investigator aims to discover associated emails, phone numbers, or linked social media profiles without alerting the user. What the “Forgot Password” Technique Does

When an investigator inputs a target’s email or username into a platform’s “forgot password” field (e.g., Facebook, Instagram, Twitter, LinkedIn), the site often reveals partial information to help the legitimate user recover their account.

This Technique Can Reveal:

• Partial Phone Numbers: e.g., “********45”.
• Alternative/Recovery Emails: e.g., “a******@gmail.com”.
• Presence Verification: Confirms if an email address or username is associated with a specific platform.
• Account Association: Confirms if a telephone number or email is linked to a target’s account.
• MFA Information: Sometimes indicates the type of 2FA (e.g., Google Authenticator, SMS) used.

How It Is Used In OSINT Investigations

OSINT investigators use this technique for several purposes:

• Verifying Targets: Confirming that a found username, phone number, or email actually belongs to the Person of Interest (POI).
• Discovering Hidden Accounts: Finding social media or other accounts linked to a single email address.
• Linking Information: Connecting a known phone number to a previously unknown email, or vice versa, by piecing together redacted information.
• Enumeration: Identifying multiple accounts belonging to the same user across different platforms — commonly using tools like Holehe.

Note: While these techniques are used for authorized investigations, using them for malicious purposes against individuals is illegal

Phase 3: Advanced Email Intelligence Tools

Thanks to Epieos, Intelbase, and Behindtheemail for their support in email intelligence collection. With these tools, OSINT analysts can gather far more useful information on any target email address.

• Epieos allows me to map out the target’s Google profile, ID, reviews, and more.
• However, my favorites are Intelbase and Behindtheemail, as they provide comprehensive email intelligence lookup analysis.

With these tools, I can collect intelligence such as:

• Target’s main name and username
• Social media footprints (direct profile links)
• Activity timeline
• Account registrations (platforms where the email was used)
• Data breaches (useful for vertical movement)

The most important factor remains the analyst’s ability to convert this information into actionable intelligence. Relying on a single source is never healthy — it can limit the success of your investigation. If Point A says “Good,” correlate the data from another source to see if both share similar characteristics.

Cognitive bias is very dangerous. Always verify your results from multiple sources before reaching a final verdict:

Username Reconnaissance > Breach Data Matching > Stylometric Analysis > Technical Footprinting > Relationship Mapping

For your OSINT report, an alias is only “verified” once it meets the Verification Triangle standard:

Corroboration > Behavioral Match > Third-Party Evidence

In one case, Epieos did not provide my target’s email profile — it was void. Additionally, the target’s social media accounts attached to their email address was also void due to unsubscription.

To many, the investigation might have hit a dead end here, but pivoting to other tools was a goldmine. Intelbase provided a much more comprehensive view of my target’s email footprints, including a detailed summary of platforms where the target’s account was registered. I find this tool far more useful than Holehe. Behindtheemail offered similar characteristics, with slight differences in data structure. Nevertheless, both tools share a common value.

Target’s email profile — it was void.

Intelbase provided a much more comprehensive view of my target’s email footprints:

Detailed summary of platforms where the target’s account was registered:

Behindtheemail offered similar characteristics:

Target Footprints:

Phase 3.1: Email Domain Reconstruction (The Reconstruction Pivot)

Sometimes you find a target’s email address, but the initial lookup returns little to no useful intelligence.

For example, I discover:

precious.vincent@yahoo.com

I run it through Holehe, Intelbase, and Epieos. The results are mostly empty — no social media accounts, no breach data, no profile information.

Most investigators would stop here. I don’t.

The Logic Behind Reconstruction

People often change email providers over time. A target who used Yahoo ten years ago may now use Gmail, Outlook, or ProtonMail. More importantly, they frequently reuse the same local-part (the part before the @ symbol) across different domains.

If precious.vincent@yahoo.com gives me nothing, I reconstruct the email address by swapping the domain while keeping the local-part intact.

How I Reconstruct

Step 1 — Extract the local-part

From precious.vincent@yahoo.com, I isolate precious.vincent

Step 2 — Swap in common email domains

I test the same local-part across multiple providers:

Step 3 — Run each reconstructed email through Phases 2 & 3

I treat each reconstructed address as a new target:

• Validate with Holehe
• Run through Epieos, Intelbase and Behindtheemail
• Utilize advanced search operators for social media footprints
• Test “Forgot Password” technique

Variations of Reconstruction

Sometimes the target uses different local-parts across domains. I also try:

Username variations:

• precious.vincent → pvincent → pvince → vincentp

Dot vs. no dot:

• precious.vincent@gmail.com
• preciousvincent@gmail.com

Numbers added/removed:

• pvincent867@yahoo.com → pvincent@outlook.com
• preciousv@protonmail.com → preciousvincent@protonmail.com

Automated vs. Manual Reconstruction

You can automate this using simple scripts, but I prefer manual reconstruction for important targets. It forces me to think like the target — predicting which provider they would have chosen at different stages of their life.

The Core Principle

What is absent on the initial domain might be present on the reconstructed domain.

Do not let one dead end - end your investigation. The target’s digital footprint may be fragmented across multiple email providers. Reconstruction helps you assemble the full picture.

When Reconstruction Works Best

• The target has changed email providers over time
• The target uses different providers for different purposes (work vs. personal)
• The original email domain is outdated or less popular (Yahoo, AOL, Hotmail)
• You have a username pattern but only one domain

When Reconstruction Fails

• The target uses completely different local-parts for each provider
• The target deletes old accounts after switching
• The target uses temporary or disposable email addresses

Even then, I still try. One successful reconstruction out of ten attempts can unlock an entire investigation.

Phase 3.2: Target Footprints — Reverse Image Search

The next step is to conduct a reverse image search on the target’s profile picture found. People often reuse the same profile image across different social media platforms. Cross-referencing this can help connect the dots:

Phase 4: Digital Directory and Identity Verification Tools

This is the most interesting part of my investigation. If the person of interest resides in the US, mapping their footprint is much easier compared to other countries due to available resources like official government directories, property records, and more.

For this, Whitepage is a goldmine. Unlike many other directories, it has no geographical barrier, making it easier to pivot. If my target resides in the US and I need to map their digital directory and identity verification, this tool is invaluable.

With Whitepage, I can gather intelligence such as:

• Target’s real name
• Home address and properties
• Relatives
• Phone numbers
• Email addresses
• Associates
• Criminal and traffic records

Again: Never rely on a single data point. Always corroborate from multiple sources before your final verdict.

Phase 5: Wayback Machine & Historical Web Lookup (NEW)

People change their online presence over time — but the internet rarely forgets.

I navigate to the Wayback Machine (archive.org) and enter any URL I’ve discovered: a deleted blog, an old LinkedIn profile, a now‑inactive forum post, or a GitHub profile that has been cleaned up.

What I look for:

• Deleted social media profiles (MySpace, old Tumblr, early Reddit)
• Old personal websites or portfolios that reveal past locations, jobs, or interests
• Changes in political or ideological stance over time
• Usernames that have been abandoned but still contain metadata

My Practical query example inside Wayback:
If my target once had a WordPress blog at preciousvincent.wordpress.com, I enter that URL into archive.org and review snapshots from earlier archives to the present. I often find email addresses, real names of family members, earlier professional life, or location check‑ins that no longer exist on the live web.

Example: The target’s current website and their older version share notable similarities, but the fragmented differences in the earlier site provided me with a critical lead into their **** life and *** profile.

Alternative tools:

• Archive.today (bypasses some robots.txt blocks)
• Google Cache (if still available)
• Lumendatabase (for historical content removal requests)

Warning: The Wayback Machine respects robots.txt inconsistently. Cross‑reference with archive.today when possible.

Phase 6: Target PDF Analysis — Mining Intelligence from Published Documents

Most investigators scroll past PDFs, thinking they are just static files. I don’t.

If a person of interest has ever published a document online — a resume, a research paper, a conference presentation, a whitepaper, a newsletter, or even a scanned contract — that document can become a goldmine of intelligence.

6.1 Locating Target Documents

The first step I take here is finding documents associated with my target. I use several search operators:

Google Dorking for documents:

> Syntax: keyword filetype:extension

> Examples given below:


"Precious Vincent" filetype:pdf
"Precious Vincent" filetype:doc OR filetype:docx
"Precious Vincent" filetype:ppt OR filetype:pptx
"Precious Vincent" filetype:xls OR filetype:xlsx
"vincentprecious" filetype:pdf

Keep in mind that search operators are highly customizable. You can narrow your investigation to match any scope — exactly as I demonstrated above when I tailored my filetype: searches to zero in on the target's professional work life rather than their personal digital footprint:

Target work life footprints > Manager names > Personal/business email addresses > Telephone numbers > Physical addresses / locations > Internal accommodation registry data

Alternative search engines for documents:

• Yandex (often indexes documents Google misses)
• Bing (specific filetype search works well here)
• PDF Search Engine (https://pdf-downloads.net)
• Google Scholar — if the target has academic publications (https://scholar.google.com)

Repository-specific searches:

• GitHub — search for PDFs uploaded to repos: extension:pdf "target name"
• ResearchGate & Academia.edu — if the target is in academia
• SlideShare — for conference presentations
• Internet Archive (Texts) — for older scanned documents

6.2 What I Extract from Every Document

Once I download a target document, I never just read it. I systematically extract the following:

A. Embedded Metadata (EXIF & Document Properties)

I run every document through ExifTool (command line) or a GUI alternative like Metadata2Go.

What I look for:

• Author name (can reveal a previous name or alias)
• Company or organization (current or past employer)
• Software version (Microsoft Word 2016 vs. 365 — can indicate license type)
• Last saved by (may reveal another person — possible associate)
• Revision number (number of edits — hints at document history)
• Creation date & modification date (establish activity timeline)
• Hidden text or comments (sometimes contains internal notes or email addresses)

Example: I download a PDF resume of the target. ExifTool reveals the author as “P. Vincent” and the last saved by field shows “mercy.vincent” — potentially a family member or shared computer user. That becomes a new pivot.

B. Hidden Layers & OCR Artifacts

Some PDFs contain layers that are invisible to the naked eye but still present.

I use qpdf or PDFiD to analyze the PDF structure, and pdf-parser (Didier Stevens) to extract hidden objects.

What I can find:

• Form fields with default values (sometimes pre-filled with real addresses)
• Annotations or sticky notes (forgotten by the author)
• OCR text layers from scanned documents (may contain handwritten notes)
• Embedded files (a PDF can contain another PDF or Excel sheet)

C. Links, Emails & Phone Numbers Inside the Document

I convert the PDF to plain text using pdftotext (Linux) or simply copy-paste, then grep/scan for:

• Email addresses (any @domain.com)
• Phone numbers (local and international formats)
• Physical addresses
• URLs (personal website, GitHub, LinkedIn, etc.)
• Usernames or handles
• Names of colleagues, supervisors, or collaborators

D. Fonts & Watermarks

Fonts and watermarks can reveal the organization that created or sponsored the document.

• Custom fonts often belong to a specific company
• Watermarks (draft, confidential, company logo) may indicate internal documents that were accidentally published
• Header/footer text can reveal department names or document control numbers

6.3 Practical Example — Real Investigation Scenario

Target: Precious Vincent (Cybersecurity professional)

Discovery: I run "Precious Vincent" "OSINT" filetype:pdf on Google and find a conference presentation from 2022 on SlideShare titled "OSINT for Red Teams."

Step 1 — Download the PDF
I download the original PDF (not just view it online).

Step 2 — Run ExifTool

exiftool precious_vincent_osint_slides.pdf

Output reveals:

• Author: Precy V.
• Last saved by: pvincent@cyberfirm.africa ← New email address
• Company: CyberFirm Africa
• Create Date: 2022:03:15
• Modify Date: 2022:03:17

Step 3 — Extract text
pdftotext precious_vincent_osint_slides.pdf output.txt

Inside the text, I find:

• A slide thanking “Team CyberFirm — especially M. Okafor” → New associate name
• A footer with internal document code: CFA-OSINT-0422
• A hidden comment in the PDF structure mentioning “update email before sharing — p.vincent@gmail.com” → Another email alias

Step 4 — Pivot
I now have:

• A work email (pvincent@cyberfirm.africa)
• A personal Gmail (p.vincent@gmail.com)
• An associate name (M. Okafor)
• A company name (CyberFirm Africa)

Each of these becomes a new search query across Phases 1–6.

6.4 Additional Document Sources to Check

Beyond standard search engines, I check these platforms for target documents:

• Scribd (users often upload resumes and reports)
• Issuu (magazines, portfolios, brochures)
• Calameo (interactive publications)
• DocDroid (simple document hosting)
• Z-Library or Library Genesis (if the target published a book or paper)
• Government Tenders & Procurement Portals (if the target bid for contracts)

6.5 Document Correlation Rule

A single document might give you one piece of information. Two documents from different years can give you a timeline of the target’s life.

I compare:

• Document creation dates vs. modification dates (did they edit a resume after changing jobs?)
• Email addresses used in older vs. newer documents (did they switch providers?)
• Physical addresses mentioned in conference registration forms vs. current Whitepage data

Example: A 2019 PDF shows the target in Lagos. A 2024 PDF shows the target in Accra. I now know they relocated. That helps me focus directory searches on Ghana instead of Nigeria.

6.6 Legal & Ethical Reminder

I only analyze documents that are publicly available — no hacking, no unauthorized access, no password-protected files. If a document is behind a login or paywall, I do not bypass it.

And as always: Never rely on a single document. Corroborate every piece of metadata with another source before accepting it as fact.

Phase 7: Entity Graph Visualization (Obsidian)

Transforming raw data into an entity visualization graph is what I love most. It presents a clear, intuitive insight into the investigation.

I use Obsidian to build a knowledge graph of the target’s digital footprint — connecting email addresses, usernames, social media profiles, locations, associates, and any breach data. This visualization often reveals relationships and patterns that raw notes cannot — making it easier for quick analysis.

This methodology is continuously evolving. Always adapt your tools and techniques to the target and the legal boundaries of your investigation.