OSINT Open Source Intelligence In Litigation

Frequently asked questions

If information is public, can we just use it?

Gather it law full y, yes, but two cautions apply (§5, §6). First, public does not mean proven: open material is often wrong, stale or fabricated, so it must be verified, dated, attributed and corroborated before it is relied on. Second, gathering and using personal data still engages the UK GDPR and must be lawful and proportionate, and the gathering must stay within access laws and platform terms. Public material is a starting point for evidence, not evidence in itself.

Why is a screenshot not good enough?

Because it proves almost nothing on its own (§4, Example 1). A screenshot can be edited or fabricated, carries no reliable date, and has no verifiable link to a real source. Properly captured OSINT records the live URL, the page source, timestamps and metadata, is hashed, and its method is documented, so its authenticity and its state on the capture date can be proved. That is the difference between evidence that holds and an image that is challenged away.

Can we set up a fake profile to see a private account?

No (§6). Creating fake profiles to befriend or deceive a subject, logging into others' accounts, or circumventing access controls is unlawful or unethical, taints any evidence obtained and exposes the practitioner. OSINT works with genuinely public material gathered by honest means. Where information sits behind access controls, it is obtained by lawful process, disclosure, orders, not by deception or unauthorised access. The line is firm: public means public.

How do we know a social-media account belongs to the person?

By corroboration, not assumption (§5). Accounts are impersonated, shared and fake, so a name or photo is not enough. Attribution is built from corroborating evidence, consistent details across posts, connections, reused handles, and, where available, device and account forensics linking the account to the person (guides 105, 126). The honest position is stated: the account is attributed to the person where the evidence supports it, and left unattributed where it does not.

Can OSINT expose fabricated evidence?

Yes, and it often does (Example 3, §5). Fabricated screenshots of posts or messages are common, and verification, checking the platform's own records and web archives, testing the account, and apply in g provenance analysis (guide 126), frequently shows that the supposed material never existed. OSINT cuts both ways: it gathers genuine public evidence and it exposes fake public evidence, provided it is done with the same verification discipline in both directions.

Is OSINT a substitute for disclosure and forensics?

No, it complements them (§7, §8). OSINT is often the fastest way to learn something and to find where formal evidence lies, but public material is unverified and limited, so it points to the disclosure to seek, the account to have attributed, the asset to trace, while the authenticated capture, platform disclosure and device forensics supply the proof. Used together, OSINT and the forensic and disclosed sources are far stronger than either alone. cflab. u k · e-disc ove r y. u k ©2026 Computer Forensics Lab Ltd ·cflab.uk ·e-discovery.uk ·info@cflab.uk ·+44 (0)20 7164 6915 Page 15 of 17