J V
All notes

NOTES · · 1 min read

OSINT as a reconstruction problem

Treating open-source intelligence like an engineering problem: collect, link, and test every edge.

A graph linking a job posting, a domain, an IP address, a certificate and a malware sample, above a timeline.
Each edge in the graph is a claim that needs its own evidence.

This is example text to show the note layout. Replace it in the CMS.

Open-source intelligence is often presented as clever searching. In practice it is closer to reconstruction: you have fragments, and you are trying to rebuild a sequence of events that someone worked hard to hide.

From fragments to a graph

A useful habit is to write every finding down as a node and every relationship as an edge, and to attach a source to each edge. A domain resolving to an IP address is an edge. So is a certificate that was reused across two servers.

Timelines keep you honest

Putting events on a timeline quickly exposes impossible stories: infrastructure that appears after it was supposedly used, or tools that did not exist yet.

Confidence, not certainty

  • High: multiple independent sources agree.
  • Medium: one strong source, consistent with the rest.
  • Low: plausible, but single-sourced or circumstantial.

Writing the confidence next to each claim makes the final report easier to trust, and easier to correct.