How OSINT Operators Build a Case Timeline

Open-source intelligence looks like searching and is actually bookkeeping. The searching produces fragments; the bookkeeping turns fragments into something that can be defended, challenged and relied upon. Every case an operator runs follows the same four phases, in the same order, for the same reason: the order is what prevents the answer being decided before the work starts.

Phase one — collection planning

Before any search, the operator writes the question in falsifiable form and lists the surfaces capable of answering it. A vague brief produces a vague sweep. 'Is there an active dating presence?' is answerable. 'Is he cheating?' is not, until it is decomposed into the specific, checkable claims underneath it.

• Identifiers held: names, handles, emails, phone numbers, images, locations, employers.
• Surfaces to cover, each with a defined stopping condition.
• Disconfirming evidence: what would show the hypothesis is wrong.
• Out of scope: what will not be attempted, and why.

Phase two — collection and source grading

Every item collected is recorded with its source, the URL, the time observed, and a grade. Grading separates what the source is from what it says. A primary artefact — the subject's own published post — is not the same as a third-party aggregator repeating it, even when both display the same sentence.

1. 01Primary and directly observed: the subject's own public content, captured at the time of observation.
2. 02Corroborated secondary: independent sources agreeing, with no shared upstream origin.
3. 03Uncorroborated secondary: plausible but single-sourced, frequently an aggregator recycling stale data.
4. 04Inferred: a conclusion drawn from pattern rather than observation, always labelled as such.

Phase three — timeline construction

Findings are placed on a single chronological line: account creation dates, activity windows, photograph first-appearance dates, location signals, and the events the client has described. Contradictions become visible immediately, and contradictions are the most valuable output of the whole process. A profile edited during an evening described as a work dinner is a finding no amount of searching would have surfaced as a standalone fact.

Phase four — confidence and reporting

Each conclusion carries an explicit confidence level, and the report states what was searched and found nothing as prominently as what was searched and found something. Negative coverage is what makes a clean result trustworthy: without it, 'nothing found' is indistinguishable from 'nobody looked'.

Bias controls

• Write the disconfirming test before searching, and run it even when the answer already seems obvious.
• Separate observation from interpretation in the record; never write a conclusion in the evidence column.
• Timebox each surface, so effort follows the plan rather than the most emotionally interesting lead.
• Have the timeline reviewed by someone who has not read the client's narrative.

An investigator who cannot state what would have changed their mind has not conducted an investigation.