Joined May 2016
508 Photos and videos
Iโ€™m excited to be presenting in Amsterdam this June! If you work in OSINT, this event is definitely worth checking out. Looking forward to seeing familiar faces and reconnecting with awesome people in the community. @SANSInstitute @SANSDefense
3
13
3,821
Looking forward to connecting with friends in Amsterdam at the SANS OSINT Summit. Iโ€™m honoured to be speaking on OSINT and Insider Threat, and excited for two days of learning from this community. See you in Amsterdam ๐Ÿ‡ณ๐Ÿ‡ฑ
5
1,128
OSINT Techniques retweeted
Unconventional payment methods like PayPal, Western Union, or cryptocurrency may be a sign of a foreign intelligence agencyโ€™s recruitment efforts. Stay vigilant and report suspicious activities. #SafeguardCanada Read the alert: ow.ly/wj4W50Z7Ete
56
30
71
23,013
OSINT Techniques retweeted
Our statement on the UK governmentโ€™s demand that all content on all devices sold or used in the country be scanned, on the presumption of nudity, using a dystopian combination of age verification and content scanning. This proposal will not safeguard children. It endangers us all. signal.org/blog/pdfs/2026-06โ€ฆ

738
8,545
41,318
2,723,444
OSINT Techniques retweeted
We will not compromise Canadian Proton VPN users. Our no-logs policy remains non-negotiable.
Canadian Government: "Bill C-22 will not break encryption." Also the Canadian Government: "... but we do want to be able to read your encrypted messages"
7
31
311
20,349
OSINT Techniques retweeted
Foreign intelligence services are using professional networking sites & online job platforms to target Five Eyes personnel who have a security clearance, military background or access to government information. #SafeguardCanada Read our newest alert: ow.ly/nS4a50Z7ist
23
51
73
16,709
OSINT Techniques retweeted
#BREAKING A Canadian man has been sentenced to 33 years in federal prison for targeting over 100 children across the U.S. in one of FBI Houston's largest sextortion cases. For years, Ramanan Pathmanathan, 40, used multiple social media accounts to contact at least 145 girls and boys demanding them to engage in sexually explicit conduct. If they declined, he threatened to send compromising images to the childrenโ€™s friends or family. This was a years-long investigation by FBI Houston's Child Exploitation and Human Trafficking Task Force and @TXDPSsoutheast. ow.ly/WJyB50Z4RLk
1,975
3,789
11,363
720,469
OSINT Techniques retweeted
Thank you to our sponsor @OSINTtechniques! Theyโ€™ve generously offered prizes to support our CTF on June 6th! You can check them out at forensicosint.com/. There are currently still tickets available at tracelabs.org/tickets #OSINT4Good #TraceLabs #MissingPeople #OSINT
2
10
1,947
OSINT Techniques retweeted
A single Strava run once gave away the position of an aircraft carrier. With 195M users, Strava is one of the largest public location datasets online. So here's a new tutorial on how to find locations on Strava, and the settings that keep your own profile private. ๐Ÿ‘‡
4
12
81
10,845
OSINT Techniques retweeted
Video Evidence Continuity Report (PDF)
2
12
2,620
OSINT Techniques retweeted
Come work with us @okta ! We're looking for a new member of Okta's Threat Intelligence team. This role is one in which if you have a good idea that fits our mission, you can run with it. Plus, we're nice people. ๐Ÿ˜€ North Korean IT workers need not apply. linkedin.com/jobs/view/44106โ€ฆ
8
40
6,532
#OSINT Easy method to download a Threads video. Remember to make it defensible as well!
๐ŸŽฅ A Client Question Worth Sharing: How to Download a Video from Threads A subscriber reached out this week with a problem: our Forensic OSINT Video Downloader supports most major social platforms, but Threads isn't one of them yet. They had a video they needed to preserve โ€” and couldn't wait for us to ship support. So we walked them through a manual workaround using nothing but Chrome. Sharing it here in case anyone else is in the same spot. We're always here to help our subscribers, whether the tool covers it or not. โš™๏ธ ๐—ง๐—ต๐—ฒ ๐˜„๐—ผ๐—ฟ๐—ธ๐—ณ๐—น๐—ผ๐˜„ โ€” ๐—ฎ๐—ฏ๐—ผ๐˜‚๐˜ ๐Ÿฎ๐Ÿฌ ๐˜€๐—ฒ๐—ฐ๐—ผ๐—ป๐—ฑ๐˜€: 1๏ธโƒฃ Open the Threads post in Chrome. 2๏ธโƒฃ Open DevTools โ†’ three-dot menu โ†’ More tools โ†’ Developer tools (or F12). 3๏ธโƒฃ Go to the Network tab, click the Media filter. 4๏ธโƒฃ Reload the page (Ctrl R). Network only captures requests made after it's open. 5๏ธโƒฃ A single .mp4 file will appear. That's it. 6๏ธโƒฃ Click the file name to open the raw video in a new tab. 7๏ธโƒฃ Right-click โ†’ "Save video as..." Done. โœ… No extensions, no sketchy third-party sites, no malware risk. โš ๏ธ ๐—ข๐—ป๐—ฒ ๐—ถ๐—บ๐—ฝ๐—ผ๐—ฟ๐˜๐—ฎ๐—ป๐˜ ๐—ฐ๐—ฎ๐˜ƒ๐—ฒ๐—ฎ๐˜: This gets you the file. That's it. No chain of custody, no timestamp, no hash, no proof of where it came from or when. For personal use, fine. For an investigation, not enough. ๐Ÿ›ก๏ธ ๐—œ๐—ณ ๐˜†๐—ผ๐˜‚ ๐—ต๐—ฎ๐˜ƒ๐—ฒ ๐˜๐—ผ ๐˜‚๐˜€๐—ฒ ๐˜๐—ต๐—ถ๐˜€ ๐—บ๐—ฒ๐˜๐—ต๐—ผ๐—ฑ, ๐—บ๐—ฎ๐—ธ๐—ฒ ๐—ถ๐˜ ๐—ฑ๐—ฒ๐—ณ๐—ฒ๐—ป๐˜€๐—ถ๐—ฏ๐—น๐—ฒ: ๐Ÿ” Hash the file immediately (SHA-256). Windows: Get-FileHash video.mp4. Mac/Linux: shasum -a 256 video.mp4. ๐Ÿ“ Document contemporaneously โ€” write notes as you go, not after. Capture full URL, date/time with timezone, username, post ID, view count. ๐Ÿ“ธ Screenshot the page, the DevTools Network panel showing the .mp4 request, and the source URL bar. ๐Ÿ’ป Note your environment โ€” browser version, OS, your name, reason for capture. ๐Ÿ—‚๏ธ Preserve the original untouched. Work from copies. Done right, this gives you a defensible record proving how the video was obtained and that it hasn't been altered since capture. โฑ๏ธ But it's manual, error-prone, and time-consuming. Miss a step and the evidence may not hold up. ๐ŸŽฏ ๐—ง๐—ต๐—ฎ๐˜'๐˜€ ๐˜๐—ต๐—ฒ ๐—ด๐—ฎ๐—ฝ ๐—ผ๐˜‚๐—ฟ ๐—ฉ๐—ถ๐—ฑ๐—ฒ๐—ผ ๐——๐—ผ๐˜„๐—ป๐—น๐—ผ๐—ฎ๐—ฑ๐—ฒ๐—ฟ ๐—ณ๐—ถ๐—น๐—น๐˜€. Every download generates a Video Evidence Continuity Report โ€” a single-page, digitally signed and timestamped PDF including: ๐Ÿ‘ค Who captured it, what, when, and how ๐Ÿ”— Full source URL and platform metadata #๏ธโƒฃ SHA-256 hash of the video file ๐Ÿ–ผ๏ธ 10 screen captures from the video as a visual reference ๐Ÿ•“ Trusted timestamp anchoring the exact capture moment Everything needed to establish authenticity and chain of custody โ€” automatically, every time. We support most major social platforms, and Threads is on the roadmap. Until then, follow the manual steps above. For everything else, let us handle it.
8
3,032
OSINT Techniques retweeted
๐ŸŽฅ A Client Question Worth Sharing: How to Download a Video from Threads A subscriber reached out this week with a problem: our Forensic OSINT Video Downloader supports most major social platforms, but Threads isn't one of them yet. They had a video they needed to preserve โ€” and couldn't wait for us to ship support. So we walked them through a manual workaround using nothing but Chrome. Sharing it here in case anyone else is in the same spot. We're always here to help our subscribers, whether the tool covers it or not. โš™๏ธ ๐—ง๐—ต๐—ฒ ๐˜„๐—ผ๐—ฟ๐—ธ๐—ณ๐—น๐—ผ๐˜„ โ€” ๐—ฎ๐—ฏ๐—ผ๐˜‚๐˜ ๐Ÿฎ๐Ÿฌ ๐˜€๐—ฒ๐—ฐ๐—ผ๐—ป๐—ฑ๐˜€: 1๏ธโƒฃ Open the Threads post in Chrome. 2๏ธโƒฃ Open DevTools โ†’ three-dot menu โ†’ More tools โ†’ Developer tools (or F12). 3๏ธโƒฃ Go to the Network tab, click the Media filter. 4๏ธโƒฃ Reload the page (Ctrl R). Network only captures requests made after it's open. 5๏ธโƒฃ A single .mp4 file will appear. That's it. 6๏ธโƒฃ Click the file name to open the raw video in a new tab. 7๏ธโƒฃ Right-click โ†’ "Save video as..." Done. โœ… No extensions, no sketchy third-party sites, no malware risk. โš ๏ธ ๐—ข๐—ป๐—ฒ ๐—ถ๐—บ๐—ฝ๐—ผ๐—ฟ๐˜๐—ฎ๐—ป๐˜ ๐—ฐ๐—ฎ๐˜ƒ๐—ฒ๐—ฎ๐˜: This gets you the file. That's it. No chain of custody, no timestamp, no hash, no proof of where it came from or when. For personal use, fine. For an investigation, not enough. ๐Ÿ›ก๏ธ ๐—œ๐—ณ ๐˜†๐—ผ๐˜‚ ๐—ต๐—ฎ๐˜ƒ๐—ฒ ๐˜๐—ผ ๐˜‚๐˜€๐—ฒ ๐˜๐—ต๐—ถ๐˜€ ๐—บ๐—ฒ๐˜๐—ต๐—ผ๐—ฑ, ๐—บ๐—ฎ๐—ธ๐—ฒ ๐—ถ๐˜ ๐—ฑ๐—ฒ๐—ณ๐—ฒ๐—ป๐˜€๐—ถ๐—ฏ๐—น๐—ฒ: ๐Ÿ” Hash the file immediately (SHA-256). Windows: Get-FileHash video.mp4. Mac/Linux: shasum -a 256 video.mp4. ๐Ÿ“ Document contemporaneously โ€” write notes as you go, not after. Capture full URL, date/time with timezone, username, post ID, view count. ๐Ÿ“ธ Screenshot the page, the DevTools Network panel showing the .mp4 request, and the source URL bar. ๐Ÿ’ป Note your environment โ€” browser version, OS, your name, reason for capture. ๐Ÿ—‚๏ธ Preserve the original untouched. Work from copies. Done right, this gives you a defensible record proving how the video was obtained and that it hasn't been altered since capture. โฑ๏ธ But it's manual, error-prone, and time-consuming. Miss a step and the evidence may not hold up. ๐ŸŽฏ ๐—ง๐—ต๐—ฎ๐˜'๐˜€ ๐˜๐—ต๐—ฒ ๐—ด๐—ฎ๐—ฝ ๐—ผ๐˜‚๐—ฟ ๐—ฉ๐—ถ๐—ฑ๐—ฒ๐—ผ ๐——๐—ผ๐˜„๐—ป๐—น๐—ผ๐—ฎ๐—ฑ๐—ฒ๐—ฟ ๐—ณ๐—ถ๐—น๐—น๐˜€. Every download generates a Video Evidence Continuity Report โ€” a single-page, digitally signed and timestamped PDF including: ๐Ÿ‘ค Who captured it, what, when, and how ๐Ÿ”— Full source URL and platform metadata #๏ธโƒฃ SHA-256 hash of the video file ๐Ÿ–ผ๏ธ 10 screen captures from the video as a visual reference ๐Ÿ•“ Trusted timestamp anchoring the exact capture moment Everything needed to establish authenticity and chain of custody โ€” automatically, every time. We support most major social platforms, and Threads is on the roadmap. Until then, follow the manual steps above. For everything else, let us handle it.
1
7
25
8,005
OSINT Techniques retweeted
May 19
Canada can be breathtaking. But even the Canadian Rockies have their limits. โ›ฐ๏ธ With AI, photos and videos can look real, even when they are not. #ThinkBeforeYouShare
118
394
3,666
647,866
OSINT Techniques retweeted
Day 1: hands-on OSINT workshops. Day 2: practitioner talks, including a keynote by Lisette Abercrombie from the Netherlands Police on the investigative mistakes that made her better. 15โ€“16 June, Amsterdam. Don't miss out: go.sans.org/0BBV36
1
3
7
1,803
OSINT Techniques retweeted
May 19
CTV Newsโ€™ investigative unit W5 has found at least 17 innocent passengers on flights originating in Canada were detained on drug smuggling allegations over the past year after their baggage tags were switched onto suitcases filled with drugs. ctvnews.ca/canada/article/exโ€ฆ
103
588
1,453
289,698
OSINT Techniques retweeted
Millions of Canadians use Signal, WhatsApp and Facebook Messenger and everyone needs to understand that C-22 will give govโ€™t the ability to force these companies to create access to those systems.
Signal warns it would pull out of Canada if made to comply with lawful access bill theglobeandmail.com/politicsโ€ฆ
39
316
1,201
155,739