Guide: Finding Missing People with OSINT (Beginner)

Understanding OSINT's role in missing persons investigations reveals essential tools, ethics, and techniques.

Gathering Initial Data

Every OSINT investigation begins with some information to identify the target. In this article, we will refer to these initial details as selectors. You are likely to receive an incomplete set of selectors at the start of your investigation and will need to expand upon these to discover further information. Common selectors include:

Legal Name
Nicknames
Photographs
Location(s)
Phone Number(s)
Email Address(es)

Conducting OSINT Investigations for Missing People

The first step in any investigation is to take the selectors you have received and use them to identify the target’s digital presence. This process applies regardless of where the missing person is located and can help uncover new clues and insights.

Legal Name & Nicknames

Google Dorking & Locations

What is Google Dorking? Google Dorking is a technique that uses advanced search operators to refine Google search results, allowing users to uncover specific information or files that are not easily accessible through standard search queries. It can be used at almost all stages of an investigation and is one of the most powerful investigative tools available to any OSINT analyst.

For a more extensive list of Google Dorking commands, visit this GitHub Gist.

Common Google Dorks for finding information on missing people include variations based on name and location, such as:

"Legal Name"
"Nickname"
"Legal Name" "Location"
"Nickname" "Location"

Here’s a simple example: searching for a target’s name along with a location to return their social media profiles and entries in the government’s company registration database.

Discovering Social Media Accounts:

You can use Google Dorks to find social media profiles using the following commands:

site:facebook.com OR site:instagram.com OR site:x.com "Legal Name"
site:facebook.com OR site:instagram.com OR site:x.com "Nickname"
site:facebook.com OR site:instagram.com OR site:x.com "Nickname" "Location"
site:facebook.com OR site:instagram.com OR site:x.com "Legal Name" "Location"

Depending on how common your target’s name is, you may end up with too many results to effectively triage. If this happens, narrow your dorks and start with those that return the least data, working backwards to the broader ones.

Google Dorking is not limited to just name and location; you can refine results by using combinations of terms specific to the individual such as:

"Name" "Company"
"Name" "Sports Team"
"Name" "Hobby"
"Name" "Political View"

Username Search Tools

If you have a target username or want to take an educated guess at their usernames, several tools can help you search across hundreds of platforms. The following GitHub tools and websites automate this process:

WhatsMyName: Assists in identifying usernames across numerous websites by providing links to potential matches based on the input, aiding in tracking a missing person’s online presence.

‍

Maigret: Finds a person’s digital footprint by searching for usernames across various platforms and generating detailed reports. You can use Maigret via the command line or via the Maigret Telegram Bot.

Sherlock: Allows investigators to discover social media profiles by searching for usernames across multiple websites, streamlining the process of tracing individuals online.

Tip: If you do not have a username for your target but have their social media, people often reuse their usernames across multiple platforms.

Email Guessing and Breached Data

If you do not have the email address of your target, finding it can be done through a variety of techniques. Tools that perform email guessing, like emailGuesser, Mailfoguess, and buster, generate hundreds of variations based on the target’s name and try to verify if those email addresses exist.

For instance, if your target’s name is Alex James Smith, the tool will generate variations such as:

AlexJamesSmith@gmail.com
Alex.James.Smith@gmail.com
AlexSmith@gmail.com

You can also consult breached data repositories like:

HaveIBeenPwned: A go-to source for researching breached credentials.

DeHashed: A paid website housing a wealth of information on breached credentials.

SnusBase: A pivotal tool for connecting multiple verified data sources.

Telegram Bots

For more advanced searching, consider exploring Telegram bots like the Leak OSINT bot, which may contain breached data not visible through other sources. Investigators can pay with cryptocurrency for varying periods.

Investigations on Social Media

Social media is the source of missing person investigations, where most of the data and pivot points are obtained due to family members, friends, and private groups collaborating to find crucial information that can lead to the missing person's reunification with their family or friends.

Social media often provides crucial information and pivot points due to posts made by family members, friends, and private groups collaborating to reunify missing individuals with their family and friends. Operational Security (OpSec) is paramount; always use covert research accounts to maintain privacy and safety.

Facebook

With its vast user base, Facebook is an invaluable starting point. Search by name or a combination of name and the city where they lived or disappeared from to uncover posts, updates, or private groups dedicated to the missing person.

Instagram

Instagram serves as a valuable secondary platform for investigating missing persons, thanks to its global reach and emphasis on photo-sharing. If the missing person’s Instagram username is known, it can be used to explore connections further. However, if the missing person’s account is private, it can halt progress as photos become inaccessible for gathering additional insights. Instagram is particularly useful for timeline analysis, revealing the person’s activities before they disappeared.

TikTok

TikTok offers metadata and is excellent for following digital footprints when a target has a presence on the platform. SecJuice has an incredible guide on investigating on TikTok.

X / Twitter

While less often usefule, X (formerly known as Twitter) can still provide relevant insights. Use tools like WhatsMyName or Maigret to check for accounts linked to the target. Using the Wayback Machine or deleted tweet finders is a way to find relevant sources of information or determine the mental state of the missing person over a long period.

Visual Analysis: Photographs & Images

When investigating missing persons, photographs and other images can serve as valuable clues. By leveraging image analysis tools, investigators can identify landmarks, track location data, or verify a person’s digital presence. Consider using the following tools to support visual analysis:

Google Lens

Google Lens uses image recognition to analyse photos, identify key features, and suggest possible locations or objects that may be relevant to the case. Google Lens can search for landmarks, buildings, or other distinguishing elements in the image, comparing the visual data from the image with an extensive database of similar images online.

Reverse Image Search

While specialised tools like Yandex and PimEyes offer advanced facial recognition and landmark identification, Google’s reverse image search remains a useful and accessible option, particularly for beginners. Google focuses on finding similar images across the web, often identifying common visual elements such as objects, locations, or even logos.

Using Google’s reverse image search is simple—users can upload an image or paste an image URL, and Google will search for matches across the internet.

GeoSpy

GeoSpy AI is a powerful tool for OSINT investigations, providing advanced geolocation capabilities by analysing images and identifying locations. It leverages AI-driven reverse image search techniques to scan photos for visual clues, such as landmarks, buildings, or geographic features, to suggest potential coordinates or regions where an image was taken. This can be particularly useful for identifying the whereabouts of missing persons or verifying locations in digital investigations.

Email & Phone Number

Emails and phone numbers are crucial data points in any OSINT investigation, providing a starting point for uncovering additional information and online profiles linked to the subject. The following tools can help gather and analyse these details:

Holehe

Holehe is a CLI tool designed for OSINT investigations that checks if an email is linked to accounts on over 120 websites, including major platforms like Twitter, Instagram, and Imgur. By leveraging the "forgot password" function, it retrieves partial data such as recovery emails or phone numbers without alerting the target. Holehe is easy to install and run either through Python or Docker.

GHunt

GHunt is a powerful tool designed to extract valuable information from Google-related data. It enables investigators to gather details from Google accounts, emails, Google Drive files, and even geolocate devices using BSSIDs. GHunt's capabilities include retrieving detailed information about an email address or a Gaia ID and performing Google Drive file investigations, all while maintaining a fully asynchronous operation.

OSINT.Industries & Epieos

OSINT Industries and Epieos support investigating email addresses and phone numbers, providing detailed information for internetinvestigations.

OSINT Industries scans multiple sources to reveal associated social media profiles, other accounts, and linked usernames, offering a comprehensive view of a target’s digital footprint.

Epieos operates similarly and has a free (limited) offering to search emails or phone numbers.

Both tools are invaluable for verifying identities, tracking fraud, and gathering key insights efficiently in missing people investigations.

Final Thoughts

OSINT provides significant opportunities for assisting in missing person investigations, especially within the UK. By leveraging publicly available data and using tools such as Google Dorking, social media searches, and specialised platforms like Maigret and WhatsMyName, investigators can gather valuable clues and insights.

However, OSINT investigations come with ethical and legal responsibilities, requiring permission from relevant authorities before proceeding. While OSINT may not solve every case, it serves as a valuable complement to traditional investigative techniques, offering new angles and opportunities to help locate missing persons.