This guide is drawn from the opening day of our OSINT Foundations course. None of it is secret. All of it is routinely skipped, and skipping it costs investigators findings that were sitting in plain sight.
Every engine sees a different web
Search engines crawl different parts of the web, rank results differently and interpret queries differently. A query that returns nothing useful on one engine can return the answer on another. Engines with strong regional market share often index local sites, local news and local-language content that global engines rank poorly or not at all. Some engines are notably better at images. Others offer modes that focus on forums, blogs or documents.
Our analysts run important queries on at least three engines, including any engine that is dominant in the region concerned, and record which engine returned what. Agreement between engines is reassuring. Disagreement is often where the finding is.
Operators: asking precisely
Most engines support a common set of operators, with small variations. Used together, they turn a vague question into a precise one.
| Operator | What it does | Typical use |
|---|---|---|
"exact phrase" |
Matches the words together, in order | Full names, company names, quoted statements |
-term |
Excludes results containing the term | Removing a famous namesake or an unrelated meaning |
OR |
Matches either term | Spelling variants, transliterations, maiden and married names |
site: |
Limits results to one domain | Everything a registry, regulator or newspaper holds on a subject |
filetype: |
Limits results to a file format | Annual reports, filings, presentations and spreadsheets |
intitle: and inurl: |
Matches words in the page title or address | Profile pages, archived announcements, specific document series |
| Date range tools | Limits results to a period | What was said about a subject before or after an event |
Good queries are built in steps. Start broad, read the results, then add a phrase, an exclusion or a site limit and see what changes. Query builders that generate complex operator strings can save typing, but an analyst who cannot explain every part of a query cannot explain what its results mean.
Settings and personalization
Engines tailor results to the searcher's location, language, history and account. That is useful for shopping and harmful for investigation, because two analysts running the same query can see different results, and neither sees what a neutral searcher would. Our analysts search from managed research environments that are signed out, carry no history and can present a chosen region. Verbatim modes, which stop the engine substituting synonyms, and explicit region and language settings make results more reproducible.
Search in the subject's language
A subject's life is documented in the language they live in. We search names in the local script as well as in transliteration, and we search for the local terms for things such as company registry, court list, tender, obituary or wedding. Machine translation helps analysts find material quickly. Anything cited in a report is translated by a native speaker, as set out on our coverage page.
The small web
Large sites dominate results. Personal blogs, small forums, club newsletters, local papers and community sites are where ordinary people mention each other, and they are often buried below the first page. Engines and modes that favor small and independent sites, and forum-specific searches, surface material the mainstream results bury.
What search engines cannot see
Search engines find pages that are linked and crawlable. They do not see inside databases that only produce a page when queried: corporate registries, court dockets, procurement portals, professional registers, archive catalogs and most newspaper archives. Search can tell you that the database exists. To see what it holds, you must query it directly. Much of the difference between a basic search and an investigation lies in knowing which databases exist for the question and the jurisdiction. Our approach to corporate records is set out in Reading a company from the outside.
Archives and deleted pages
Web archives preserve earlier versions of many pages, including pages that have since been deleted or edited. Comparing versions shows what a company used to claim, when a name disappeared from a staff page or when a statement was quietly changed. Archived copies are captured and hashed like any other evidence, with the archive's own capture date recorded.
Open directories: open is not the same as public
Search engines sometimes index file listings on misconfigured servers, and specialized search tools exist to find them. They can contain anything from published reports to material plainly not intended to be public. We treat them with care. Our analysts open them only inside isolated research environments, because their contents are untrusted. Where a directory appears to expose personal data, confidential material or stolen content, the analyst stops, records the location and escalates for legal review before anything further is accessed. We do not download such material wholesale, and we never treat reachable as permitted.
Log every query, including the empty ones
Every query is recorded with the engine, the settings, the time and a note of what it returned. Searches that found nothing are logged as carefully as those that succeeded. They show what was checked, stop colleagues repeating work and let a reviewer judge whether the search was thorough. A report that says "no adverse media was found" means very little unless someone can see where, and how, it was looked for.
Practice on yourself
The best way to learn search is to run it against the one subject you are entitled to research without limit: yourself. Search your own name, usernames, old addresses and employers across several engines, in each language you have lived in. Most people who do this find something they had forgotten. It is also the most effective argument we know for cleaning up your own footprint.