Skip to content
OSINT Tradecraft
OSINT Tradecraft
Investigation skills · Vol. 8
Master index

659 skills.
Every one of them, browsable.

Read what's in the library before you buy. Pick a volume to see exactly what it includes, or search across all 659.

Browse by volume
659 / 659

OSINT — seed & pivot

10 skills
  • 001Seed Discovery From Name
  • 002Seed Discovery From Email
  • 003Seed Discovery From Phone
  • 004Seed Discovery From Username
  • 005Seed Discovery From Photo
  • 006Seed Discovery From Domain
  • 007Seed Discovery From License Plate
  • 008Alias and Handle Pivoting
  • 009Username Enumeration Across Platforms
  • 010Email Permutation and Verification

OSINT — media & geolocation

9 skills
  • 011Reverse Image Search Workflow
  • 012Exif and Image Metadata Analysis
  • 013Geolocation From Image
  • 014Chronolocation From Image
  • 015Shadow Corroboration Geolocation
  • 016Video Content Geolocation
  • 017Satellite and Aerial Imagery Research
  • 018Street View and Mapillary Corroboration
  • 901OSINT Image Investigation

OSINT — archival & deep web

8 skills
  • 019Wayback Machine Deep Dive
  • 020Archive Today and Google Cache
  • 021Dark Web Investigation
  • 022Paste Site Monitoring
  • 023Breach Data Correlation
  • 024Data Broker Aggregation
  • 025Forum and Imageboard Research
  • 902Webpage Evidence Preservation Wayback

OSINT — records

16 skills
  • 026Corporate Filings Research
  • 027Court Records Search by Jurisdiction
  • 028Property Records Tracing
  • 029Vehicle Records Tracing
  • 030Vessel and Maritime Tracking
  • 031Aircraft and Flight Tracking
  • 032Shipping and Cargo Tracking
  • 033Trademark and Patent Research
  • 034Genealogy and Vital Records
  • 035Obituary Research
  • 036Campaign Finance Research
  • 037Lobbying Disclosure Research
  • 038Nonprofit 990 Research
  • 039SEC EDGAR Research
  • 040Regulatory Licensing Lookup
  • 903Mystery LLC Owner Unwinding

OSINT — technical infrastructure

8 skills
  • 041Domain and Whois Research
  • 042IP and ASN Attribution
  • 043SSL Certificate Pivoting
  • 044DNS History and Passive DNS
  • 045CDN and Origin Discovery
  • 046Github and Source Leak Search
  • 047Cloud Bucket Discovery
  • 048Mobile App Ownership Attribution

OSINT — platforms

12 skills
  • 049Linkedin Investigation
  • 050Facebook and Meta Investigation
  • 051Instagram Investigation
  • 052Twitter X Investigation
  • 053Tiktok Investigation
  • 054Reddit Investigation
  • 055Discord Investigation
  • 056Telegram Channel Investigation
  • 057Youtube Investigation
  • 058Mastodon and Activitypub Investigation
  • 059Dating App Presence Detection
  • 060Live Stream Platform Investigation

OSINT — crypto & financial

8 skills
  • 061Crypto Wallet Tracing Btc
  • 062Crypto Wallet Tracing Eth
  • 063Crypto Mixer and Bridge Tracing
  • 064Nft Provenance Research
  • 065Dark Market Vendor Attribution
  • 066Payment Rail Tracing Fiat
  • 067Sanctions and PEP Screening
  • 652Cryptocurrency Investigation Overview

Digital forensics — acquisition

8 skills
  • 068Evidence Acquisition Workflow
  • 069Disk Imaging With Chain of Custody
  • 070Write Blocker and Hashing Protocol
  • 071Memory Acquisition and Analysis
  • 072Mobile Extraction IOS
  • 073Mobile Extraction ANDROID
  • 074Cloud Evidence Preservation
  • 075Live System Triage

Digital forensics — analysis

15 skills
  • 076Browser Artifact Analysis
  • 077Email Header Forensics
  • 078Windows Registry Forensics
  • 079Macos System Forensics
  • 080Linux System Forensics
  • 081File Carving and Recovery
  • 082Timeline Reconstruction
  • 083Log Correlation Multi Source
  • 084Pcap and Network Forensics
  • 085Malware Triage Static
  • 086Malware Triage Dynamic
  • 087Ransomware Incident Triage
  • 088Document Forensics Pdf
  • 089Document Forensics Office
  • 090USB and Removable Media Forensics

Digital forensics — media authentication

8 skills
  • 091Steganography Detection
  • 092Deepfake and Synthetic Media Detection
  • 093Audio Authentication
  • 094Video Forensics Frame Analysis
  • 095Image Manipulation Detection
  • 096IOT Device Forensics
  • 097Vehicle Infotainment Forensics
  • 645Generative AI Content Detection

Legal / procedure

18 skills
  • 098Evidence Admissibility Checklist
  • 099Chain of Custody Documentation
  • 100Spoliation and Preservation Letters
  • 101FOIA and Public Records Requests
  • 102Subpoena Drafting Civil
  • 103Expert Witness Preparation
  • 104Expert Witness Report Format
  • 105Deposition Prep Workflow
  • 106Discovery Document Review
  • 107Privilege Log Construction
  • 108Redaction Workflow Sensitive Data
  • 109Jurisdictional Privacy Law Quickref
  • 110GDPR and Cross Border Evidence
  • 111FCRA GLBA Compliance for Investigators
  • 112Cross Jurisdictional Service of Process
  • 113Mandatory Reporting Obligations
  • 114MLAT and International Evidence Requests
  • 629Prosecution Theory and Elements Analysis

Surveillance / tradecraft

13 skills
  • 115Surveillance Planning and Mission Brief
  • 116Static Observation Post Setup
  • 117Mobile Foot Surveillance
  • 118Mobile Vehicle Surveillance Single
  • 119Mobile Vehicle Surveillance Team
  • 120Counter Surveillance Detection
  • 121Surveillance Detection Route Personal
  • 122Covert Photography Evidence Capture
  • 123Surveillance Log and Timekeeping
  • 124Opsec for Investigators
  • 125Communications Security Team
  • 126Cover and Persona Development
  • 654Surveillance Detection and Counter Surveillance Routes

Interviewing — core

6 skills
  • 127Interview Planning and Pretext
  • 128PEACE Model Interviewing
  • 129Cognitive Interview Technique
  • 130Detecting Deception Evidence Based
  • 131Witness vs Subject Interviewing
  • 132Taking and Transcribing Statements

Report writing

10 skills
  • 133Investigative Report Structure
  • 134Executive Summary Craft
  • 135Evidence Citation Format
  • 136Timeline Presentation in Reports
  • 137Witness Statement Format
  • 138Due Diligence Report Template
  • 139Background Check Report Template
  • 140Threat Assessment Report
  • 141Intelligence Product Typology
  • 142Confidence and Uncertainty Language

Research craft

6 skills
  • 143Source Evaluation Craap
  • 144Primary Secondary Tertiary Sources
  • 145Citation Management Investigators
  • 146Archival Research Workflow
  • 147Newspaper Archive Search
  • 148Specialty Database Discovery

Specialty investigations

12 skills
  • 149Skip Tracing Workflow
  • 150Asset Tracing and Lifestyle Analysis
  • 151Pre Transaction Due Diligence
  • 152Pre Employment Background Check
  • 153Insurance Fraud Investigation
  • 154Workplace Investigation
  • 155Financial Fraud Investigation
  • 156Anti Money Laundering Investigation
  • 157Insider Threat Investigation
  • 158Missing Persons Investigation
  • 159Corporate and Competitive Intelligence
  • 160Brand Protection Investigation

Biometrics & recognition tech

10 skills
  • 161Facial Recognition Investigative Use
  • 162Facial Recognition Results Validation
  • 163License Plate Recognition ALPR Investigations
  • 164License Plate Investigative Lookups
  • 165Voice and Speaker Recognition Basics
  • 166Gait Recognition From Cctv
  • 167Tattoo Recognition and Cataloging
  • 168Fingerprint Comparison ACEFV Method
  • 169DNA Familial and Genealogy Search Protocols
  • 170Iris Recognition Context and Limits

Social media — deeper

15 skills
  • 171Boolean Search Syntax by Platform
  • 172Cross Platform Persona Linking
  • 173Social Media Evidence Preservation
  • 174Closed Group Investigation Lawful Access
  • 175Sock Puppet Account Maintenance Lawful
  • 176Snapchat Ephemeral Content Strategy
  • 177Nextdoor and Neighborhood App Investigation
  • 178Strava and Fitness App Investigation
  • 179Twitch and Livestream Archive
  • 180Adult Platform Investigation Lawful
  • 181Bereal and Ephemeral Platform Investigations
  • 182Bot Network and Cib Detection
  • 183Misinformation and Disinformation Tracing
  • 184Doxxing Pattern Analysis and Counter
  • 185Online Harassment and Stalking Investigation

Warrants & legal instruments

17 skills
  • 186Search Warrant Drafting
  • 187Arrest Warrant Drafting
  • 188Wiretap Title Iii Application
  • 189Pen Register Trap and Trace Application
  • 190Geofence Warrant Drafting
  • 191Reverse Keyword Warrant Drafting
  • 192SCA 2703d Order Drafting
  • 193Letters Rogatory and MLAT Requests
  • 194Grand Jury Subpoena Drafting
  • 195Administrative Subpoena Drafting
  • 196Civil Investigative Demand CID
  • 197Cease and Desist Letter Drafting
  • 198Demand Letter Drafting
  • 199Affidavit Drafting for Warrants
  • 200Declaration Drafting
  • 201Motion to Compel Drafting
  • 202Protective Order Drafting

Grant writing

9 skills
  • 203Grant Prospecting and Funder Research
  • 204Letter of Intent Loi Drafting
  • 205Grant Narrative Structure
  • 206Logic Model Development
  • 207Evaluation Plan and Metrics Design
  • 208Budget and Budget Justification
  • 209Federal Grant Workflow Grants Gov Sam
  • 210Foundation Grant Workflow
  • 211Boilerplate and Grant Library Maintenance

Arson & fire investigation

8 skills
  • 212Fire Scene Examination NFPA921
  • 213Origin and Cause Determination
  • 214Burn Pattern Analysis
  • 215Accelerant Detection and Canine Coordination
  • 216Electrical Fire vs Arson Differentiation
  • 217Vehicle Arson Investigation
  • 218Insurance Arson Red Flags
  • 219Wildland Fire Origin Investigation

Health & safety code enforcement

9 skills
  • 220Code Enforcement Workflow
  • 221Administrative Inspection Authority
  • 222Violation Notice Drafting
  • 223Abatement Order Drafting
  • 224Food Safety Inspection Protocol
  • 225Building and Housing Code Investigation
  • 226Hazmat Incident Investigation
  • 227Osha Workplace Safety Investigation
  • 228Environmental Enforcement Investigation

Interview & interrogation — expanded

17 skills
  • 229Reid Technique and Its Critiques
  • 230HIG Rapport Based Interrogation
  • 231Strategic Use of Evidence SUE
  • 232Funnel and Cone Questioning
  • 233Interview Room Setup and Recording Standards
  • 234Tactical Empathy and Mirroring
  • 235Juvenile Interview Protocols
  • 236Vulnerable Witness Interview Protocols
  • 237Trauma Informed Interviewing
  • 238Forensic Interview of Children Ncac Model
  • 239Hostile Witness Handling
  • 240Interpreter and Translator Use in Interviews
  • 241Miranda Warning and Waiver Documentation
  • 242Custodial vs Non Custodial Analysis
  • 243Consent to Search Dialogue and Documentation
  • 244Confession Corroboration and False Confession Risks
  • 650Witness Credibility Assessment

Social engineering (lawful)

12 skills
  • 245Pretexting Framework Lawful
  • 246Vishing Engagement Design
  • 247Smishing Engagement Design
  • 248Phishing Campaign Design Authorized
  • 249Physical Pretext Tailgating Assessment
  • 250USB Drop Engagement Design
  • 251OSINT for Engagement Targeting
  • 252Pretext Call Script Development
  • 253Elicitation vs Interrogation vs Pretext
  • 254Defensive Social Engineering Training Design
  • 255BEC Business Email Compromise Investigation
  • 256Social Engineering Engagement Reporting

Crime scene & physical evidence

15 skills
  • 257Crime Scene Photography
  • 258Crime Scene Sketching and Measurement
  • 259Evidence Collection and Packaging
  • 260Bloodstain Pattern Analysis Basics
  • 261Bullet Trajectory Analysis
  • 262Footwear and Tire Impression Evidence
  • 263Latent Fingerprint Lift
  • 264Trace Evidence Collection
  • 265DNA Evidence Handling
  • 266Toolmark Evidence Collection
  • 267Firearm Evidence Handling
  • 268Gsr Gunshot Residue Collection
  • 269Vehicle Crime Scene Processing
  • 270Outdoor and Buried Scene Processing
  • 271Postmortem Interval Estimation Context

Death investigation

6 skills
  • 272Death Scene Investigation
  • 273Coroner vs Medical Examiner Systems
  • 274Autopsy Report Interpretation
  • 275Equivocal Death Analysis
  • 276Mass Fatality Victim Identification
  • 277Suicide Investigation Protocol

Cybercrime case types

12 skills
  • 278Sim Swap Investigation
  • 279Romance Scam and Pig Butchering Investigation
  • 280Sextortion Investigation
  • 281Swatting Investigation
  • 282Account Takeover Investigation
  • 283CSAM Investigation Procedures NCMEC
  • 284Online Stalking and Cyberharassment
  • 285Tech Abuse and Coercive Control Investigation
  • 286Cryptojacking Investigation
  • 287Ddos Attribution Investigation
  • 288Nation State Attribution Indicators
  • 904Suspicious Recruiter and Job Offer Check

Threat assessment & behavioral

8 skills
  • 289Targeted Violence Threat Assessment
  • 290Stalking Case Management
  • 291Workplace Violence Threat Assessment
  • 292School Threat Assessment
  • 293WAVR21 and Similar Instruments Overview
  • 294Pre Attack Behavior Indicators
  • 295Insider Threat Behavioral Indicators
  • 296Domestic Extremism Case Indicators

Public records — deeper

7 skills
  • 297State Sunshine Law Quickref
  • 298FOIA Appeal Strategy
  • 299Pacer and Federal Court Search
  • 300State Court Records by Jurisdiction
  • 301DMV and Motor Vehicle Records by State
  • 302Restricted Records Driver Privacy Protection Act
  • 303Historical Records and RG Discovery At Nara

Surveillance technology

8 skills
  • 304GPS Tracker Legality and Use
  • 305Body Camera Protocols and Redaction
  • 306Cctv Canvassing Workflow
  • 307Drone Surveillance Legality and Use
  • 308Pole Camera and Fixed Surveillance
  • 309CSLI Cell Site Data Investigation
  • 310Vehicle Telematics Onstar Tesla Investigation
  • 311TSCM Technical Surveillance Countermeasures Basics

Vehicle investigation

6 skills
  • 312VIN Tracing and History
  • 313Auto Theft Investigation
  • 314Hit and Run Reconstruction Basics
  • 315Commercial Vehicle Eld Investigation
  • 316Vehicle Event Data Recorder EDR Extraction
  • 317Vehicle Cloning and Title Fraud

Financial / forensic accounting

10 skills
  • 318Forensic Accounting Fundamentals
  • 319Bank Record Analysis
  • 320Lifestyle Audit vs Known Income
  • 321Net Worth Method Analysis
  • 322BSA CTR SAR Investigative Use
  • 323Cash Flow Analysis
  • 324Shell Company Pierce the Veil Analysis
  • 325Cryptocurrency Tax and Trace Cross Reference
  • 326Staged Accident and Claim Red Flags
  • 327Medical Billing Fraud Investigation

Vulnerable populations

8 skills
  • 328Elder Abuse Investigation
  • 329Child Abuse Investigation MDT CAC Model
  • 330Domestic Violence Investigation
  • 331Human Trafficking Case Identification
  • 332Sex Trafficking Investigation
  • 333Labor Trafficking Investigation
  • 334CSE Online Child Exploitation Investigation
  • 335Dependent Adult Financial Exploitation

Public corruption / sting

5 skills
  • 336Sting Operation Planning Lawful
  • 337Bribery and Kickback Investigation
  • 338Conflict of Interest Investigation
  • 339Procurement Fraud Investigation
  • 340Public Official Asset and Disclosure Review

Source handling

5 skills
  • 341Chs Confidential Source Recruitment
  • 342Source Vetting and Reliability Grading
  • 343Source Motivation Analysis MICE RASCLSE
  • 344Source Tasking and Debriefing
  • 345Source Documentation and Deconfliction

Case management & documentation

7 skills
  • 346Case File Structure and Numbering
  • 347Investigative Activity Log Discipline
  • 348Field Notebook Standards
  • 349Photo Log Standards
  • 350Evidence Inventory Management
  • 351Case Timeline Maintenance
  • 352Multi Investigator Deconfliction

Analytical tradecraft

9 skills
  • 353Link Analysis Charting Discipline
  • 354Pattern of Life Analysis
  • 355Timeline Analysis Software Workflow
  • 356Geospatial Pattern Analysis
  • 357Analytic Confidence Language ICD203
  • 358Analysis of Competing Hypotheses ACH
  • 359Red Team Analysis for Investigations
  • 360Structured Brainstorming for Leads
  • 651Entity Resolution and Deduplication

Specialty enforcement

6 skills
  • 361Animal Cruelty Investigation
  • 362Wildlife Crime Scene Processing
  • 363Illegal Dumping Investigation
  • 364Timber and Natural Resource Theft
  • 365Cultural Property and Art Theft Investigation
  • 366Agricultural and Livestock Theft Investigation

Court & testimony

6 skills
  • 367Pre Trial Conference Prep
  • 368Investigator Testimony Fundamentals
  • 369Demonstrative Evidence Design
  • 370Trial Exhibit Management
  • 371Cross Examination Prep for Investigators
  • 372Voir Dire Prep for Investigators

Counterintelligence-adjacent

5 skills
  • 373Foreign Influence Indicators Corporate
  • 374Economic Espionage Indicators
  • 375Supply Chain Investigation
  • 376Insider Recruitment Warning Signs
  • 377Travel and Conference Risk Assessment

OSINT — commercial platforms

23 skills
  • 378Maltego Investigation Workflow
  • 379Spiderfoot and Spiderfoot Hx Workflow
  • 380Recon Ng Workflow
  • 381Theharvester Workflow
  • 382Hunchly Case Capture
  • 383Shodan Investigative Queries
  • 384Censys Investigative Queries
  • 385Binaryedge and Zoomeye Queries
  • 386FOFA Queries
  • 387Securitytrails and Domaintools Iris
  • 388Farsight DNSDB and Passivetotal
  • 389Intelx Workflow
  • 390Constella Intelligence Workflow
  • 391Babel X and Dataminr Workflow
  • 392Recorded Future Workflow
  • 393Flashpoint Workflow
  • 394Zerofox and Brand Protection Platforms
  • 395Darkowl and Searchlight Workflow
  • 396Skopenow and Equivalents Workflow
  • 397Pipl and People Aggregator Workflow
  • 398Accurint Lexisnexis Investigative Workflow
  • 399Tlo and Irbsearch Workflow
  • 400Tracers and Clear Investigative Workflow

OSINT — facial & image

8 skills
  • 401Pimeyes Facial Search Workflow
  • 402Facecheck ID Workflow
  • 403Search4faces Workflow
  • 404TINEYE Reverse Image Workflow
  • 405YANDEX Reverse Image Workflow
  • 406Google Lens Investigative Use
  • 407Clearview Context and Policy
  • 905Found Camera Owner Identification

OSINT — breach & credential data

8 skills
  • 408HIBP and Account Breach Mapping
  • 409Dehashed Investigative Queries
  • 410Snusbase and Leakcheck Workflow
  • 411Breach Data Ethics and Legal Use
  • 412Credential Stuffing Traceback
  • 413Infostealer Log Investigation
  • 414Paste and Leak Monitoring Pipeline
  • 415Darknet Marketplace Monitoring

OSINT — geospatial & imagery

15 skills
  • 416Google Earth Pro Investigative Use
  • 417Bing Maps Birds Eye Investigative Use
  • 418Mapillary Investigative Canvass
  • 419Kartaview and Streetside Canvass
  • 420Suncalc and Shadow Corroboration
  • 421Peakvisor and Skyline Corroboration
  • 422Sentinel Hub Satellite Tasking
  • 423Planet Labs Satellite Tasking
  • 424Usgs Earth Explorer Archival Imagery
  • 425LIDAR and Elevation Data Analysis
  • 426Wigle WIFI and BT Geolocation
  • 427Cell Tower Database Lookups
  • 428Flight Tracking Adsbexchange Investigative Use
  • 429AIS and Dark Vessel Investigation
  • 430Acoustic Geolocation From Background Sound

OSINT — cyber/tech infrastructure

12 skills
  • 431Nmap Investigative Recon
  • 432Virustotal Pivoting
  • 433Urlscan Io Investigative Use
  • 434Hybrid Analysis and Any Run Triage
  • 435Joesandbox Investigative Use
  • 436Malwarebazaar and Malshare Pivoting
  • 437Abuseipdb and Greynoise Attribution
  • 438VALIDIN and Passive DNS Pivoting
  • 439Riskiq Passivetotal Deep Pivot
  • 440Wayback Cdx Api Bulk Recovery
  • 441Common Crawl Investigative Queries
  • 442Crt Sh and Certificate Transparency Pivoting

OSINT — analyst suites

7 skills
  • 443I2 Analyst Notebook Charting
  • 444Sentinel Visualizer Charting
  • 445Palantir Gotham Workflow LE Context
  • 446Aleph OCCRP Workflow
  • 447Opencorporates Investigative Queries
  • 448ICIJ Offshore Leaks and Followthemoney
  • 449Littlesis and Power Mapping

OSINT — sanctions, PEP, adverse media

8 skills
  • 450OFAC Sdn Screening Workflow
  • 451Un Eu Uk Sanctions Screening
  • 452PEP Politically Exposed Persons Screening
  • 453Adverse Media Screening
  • 454UBO Beneficial Ownership Tracing
  • 455Offshore Company Research ICIJ Style
  • 456Sanctions Evasion Pattern Investigation
  • 457Export Control and Dual Use Investigation

OSINT — regional / language

8 skills
  • 458Russian Language OSINT
  • 459Chinese Language OSINT Weibo Wechat Baidu
  • 460Arabic Language OSINT
  • 461Persian Farsi OSINT
  • 462Spanish Latam OSINT
  • 463Script Identification and Romanization
  • 464Chat Slang and Imageboard Jargon Translation
  • 465Regional Platform Discovery Russia Iran China

Conflict-zone & military OSINT

8 skills
  • 466Bellingcat Verification Methodology
  • 467Weapon System Visual Identification
  • 468Military Uniform and Unit Identification
  • 469Battle Damage Assessment From Imagery
  • 470Conflict Zone Geolocation
  • 471Sanctions Busting Investigation
  • 472Dark Fleet and Shadow Tanker Investigation
  • 473Dual Use Procurement Network Mapping

Constitutional / 4A doctrine

13 skills
  • 474Reasonable Expectation of Privacy Framework
  • 475Plain View Doctrine Application
  • 476Exigent Circumstances Justification
  • 477Consent Search Validity
  • 478Terry Stop and Frisk Standards
  • 479Border Search Exception and Digital Devices
  • 480Inventory Search Doctrine
  • 481Probation Parole Search Conditions
  • 482Third Party Doctrine and Carpenter Erosion
  • 483Riley V California Phone Search Standards
  • 484Jones and GPS Tracking Standards
  • 485Inevitable Discovery and Attenuation Doctrines
  • 486Brady Giglio Disclosure Obligations

Specialized filings & reports

13 skills
  • 487SAR Suspicious Activity Report Drafting
  • 4888300 Cash Transaction Report Drafting
  • 489IC3 Internet Crime Complaint Drafting
  • 490NCIC Entry and Hit Confirmation
  • 491ATF ETRACE Firearm Trace Requests
  • 492NIBIN Ballistics Submission
  • 493CODIS DNA Submission
  • 494IAFIS NGI Fingerprint Submission
  • 495FINCEN 314a Search Requests
  • 496FINCEN 314b Information Sharing
  • 497FINCEN Geographic Targeting Order Response
  • 498Treasury OFAC Blocking Report
  • 499NCMEC Cybertipline Submission

International cooperation

6 skills
  • 500Interpol Notice System Red Blue Green Yellow
  • 501Europol Channels and Emls
  • 502Hague Evidence Convention Requests
  • 503International Asset Recovery Workflow
  • 504Egmont Group Fiu Coordination
  • 505Cross Border Data Request Cloud Act

Forensic linguistics & document analysis

8 skills
  • 506Forensic Linguistics Overview
  • 507Stylometry and Authorship Attribution
  • 508Threat Letter Analysis
  • 509Ransom Note and Extortion Analysis
  • 510Scan Statement Analysis and Its Critiques
  • 511Handwriting Comparison Context and Limits
  • 512Questioned Document Examination Overview
  • 513Ink Paper and Printing Process Analysis

Behavioral / profiling

8 skills
  • 514Investigative Criminal Profiling Overview
  • 515Geographic Profiling Rossmo Method
  • 516Modus Operandi Analysis
  • 517Signature vs Mo Analysis
  • 518Victimology Framework
  • 519Staging and Crime Scene Presentation Analysis
  • 520Linkage Blindness and Cross Case Analysis
  • 521Serial Offender Investigation Framework

Cold case

7 skills
  • 522Cold Case Review Methodology
  • 523Forensic Genetic Genealogy FGG Workflow
  • 524Forensic Art and Age Progression Coordination
  • 525Cold Case Witness Re Interview
  • 526Unidentified Human Remains NAMUS Workflow
  • 527Cold Case Evidence Retesting Prioritization
  • 528Cold Case Public Appeal Strategy

Investigator soft skills & bias

10 skills
  • 529Rapport Building Stages
  • 530Active Listening Framework
  • 531Note Taking During Interviews
  • 532Confirmation Bias Counters
  • 533Tunnel Vision Counters
  • 534Anchoring Bias Counters
  • 535Availability Heuristic Counters
  • 536Investigator Self Care and Vicarious Trauma
  • 537Working Alone Safety Protocols
  • 538Squad and Task Force Dynamics

Specialty / sensitive case types

10 skills
  • 539Cult and Coercive Group Investigation
  • 540Religious Institution Misconduct Investigation
  • 541Youth Org and Sports Abuse Investigation
  • 542Title Ix Investigation Workflow
  • 543Hr Workplace Investigation Expanded
  • 544Hate Crime Investigation
  • 545Bias Incident vs Hate Crime Determination
  • 546Hostage Negotiation Fundamentals
  • 547Kidnap Ransom Corporate Response
  • 548Proof of Life Protocols

Influence ops / disinfo

10 skills
  • 549Election Interference Investigation
  • 550Foreign Influence On Social Media
  • 551Astroturfing Detection
  • 552Paid Troll and Bot Farm Investigation
  • 553Narrative Laundering Tracing
  • 554Deepfake Political Content Attribution
  • 555Coordinated Amplification Detection
  • 556Media Cloning and Fake Outlet Detection
  • 643Social Media Bot Detection
  • 644Psyop and Influence Operations Analysis

Cloud-platform investigations

9 skills
  • 557AWS Evidence Collection and Cloudtrail Analysis
  • 558Azure Evidence Collection and Audit Log Analysis
  • 559GCP Evidence Collection and Cloud Logging
  • 560M365 Purview and UAC Investigation
  • 561Google Workspace Investigation
  • 562Slack Discovery and Investigation
  • 563Microsoft Teams Investigation
  • 564Zoom Recording and Meeting Investigation
  • 565Okta and IDP Investigation

IoT / smart device specific

11 skills
  • 566Apple Watch and Wearable Forensics
  • 567Fitbit and Garmin Data Investigation
  • 568Ring and Doorbell Camera Investigation
  • 569Nest and Thermostat Data Investigation
  • 570Alexa Echo Investigation
  • 571Google Home Investigation
  • 572SMART TV Investigation
  • 573SMART Lock and Access Control Investigation
  • 574Connected Car Infotainment Deep
  • 575Vehicle EDR Airbag Control Module Extraction
  • 653Drone and Uas Forensics

DFIR tools

12 skills
  • 576Autopsy Investigation Workflow
  • 577FTK and FTK Imager Workflow
  • 578Encase Investigation Workflow
  • 579X Ways Forensics Workflow
  • 580Magnet Axiom Workflow
  • 581Cellebrite UFED Workflow
  • 582Graykey and IOS Extraction Workflow
  • 583Volatility Memory Analysis
  • 584Plaso Log2timeline Workflow
  • 585KAPE Collection Workflow
  • 586Velociraptor Investigation Workflow
  • 587Wireshark and Zeek Investigative Use

Cryptocurrency specific tools

9 skills
  • 588Chainalysis Reactor Investigation
  • 589Trm Labs Investigation
  • 590Elliptic Investigation
  • 591Etherscan Investigative Use
  • 592Solana Investigation Workflow
  • 593Monero Investigation Context and Limits
  • 594Mixer and Coinjoin Tracing Techniques
  • 595Cross Chain Bridge Tracing
  • 596Defi Protocol Investigation and Rug Pull Tracing

Red Team and Adversary Tactics

15 skills
  • 597Delivery Impersonation Physical Entry Execution
  • 598Tailgating Execution Tradecraft
  • 599Phone Pretext Call Execution
  • 600Vishing Redirect and Pivot
  • 601Smishing Conversion and Handoff
  • 602Badge Cloning Execution Authorized
  • 603USB Drop Operational Execution
  • 604Dumpster Diving Authorized Execution
  • 605Social Engineering Conversation Control
  • 606Building Recon Pre Engagement No Entry
  • 607Pretext Blown Recovery Tradecraft
  • 646Red Team Rules of Engagement Drafting
  • 647Red Team Arrest and Detention Contingency
  • 648Red Team After Action Reporting Discipline
  • 649Client Debrief and Defensive Controls Translation

Executive protection & travel security

10 skills
  • 608Executive Protection Advance Work
  • 609Executive Protection Motorcade Fundamentals
  • 610Executive Protection Residence Security Survey
  • 611Protective Driver and Evasive Driving Tradecraft
  • 612Protective Intelligence and Threat Assessment for Ep
  • 613Hostile Environment Awareness Training Fundamentals
  • 614International Pre Travel Risk Assessment
  • 615Duty of Care and Iso 31030 Travel Security
  • 616Medical Evacuation and Trauma Readiness
  • 617Corporate Extortion and Virtual Kidnap Response

PI practice management

5 skills
  • 618Pi Licensing and Multi State Reciprocity
  • 619Eo Insurance for Investigators
  • 620Engagement Letter and Scope Drafting
  • 621Pre Engagement Conflict Check
  • 622Client Confidentiality and Privilege Handling

Process service & civil enforcement

6 skills
  • 623Service of Process Fundamentals
  • 624Service On Business and Government Entities
  • 625Substituted Service and Service by Publication
  • 626Bail Enforcement and Fugitive Recovery Legality
  • 627Cross State Apprehension Considerations
  • 628Repossession Investigation and Asset Location

Insurance investigations (SIU)

4 skills
  • 630Recorded Statement Protocol
  • 631Euo Examination Under Oath Prep
  • 632Siu Special Investigations Unit Coordination
  • 633Subrogation Investigation

Investigative journalism craft

9 skills
  • 634Fact Checking Workflow
  • 635Numerical Claim Verification
  • 636Document Leak Vetting
  • 637Newsroom Pre Publication Legal Review
  • 638Source Protection Securedrop Signal
  • 639Coordinated Investigation Publishing
  • 640Database Journalism Investigation
  • 641Document Centric Story Structure
  • 642Series Investigation Structure
Want them in your agent?

Reading the index is free. Running them isn't.

Pick a volume, build a stack, or start with the free Starter and decide from there.

Skill index — Browse all 659 skills · OSINT Tradecraft