Every digital action creates a trace. A forum post, a social media profile, a domain registration—each is a fragment of a larger online identity. An individual investigation is the process of discovering, linking, and verifying these disparate fragments to build a cohesive and accurate picture of a person's online presence and activities. This rambling dives into the methodology for conducting such an analysis. This is not about uncovering private data, but about the systematic process of using publicly available information to follow a trail. The core principle is the pivot: the act of taking one known piece of information and using it to uncover another. ## Starting Points: The Initial Threads Nearly every investigation begins with a single data point. The most common starting points are usernames, email addresses, and real names. The initial goal is to expand this single point into a collection of associated accounts and assets. ### The Username Usernames are the most common starting point and often the most fruitful. People are creatures of habit, and they frequently reuse the same username—or slight variations of it—across multiple services. * **Initial Search:** The simplest first step is to perform a search engine query using the exact username in quotes (e.g., `"targetuser123"`). This will immediately reveal public profiles on major platforms that are indexed by search engines. * **Username Checkers:** To go beyond what Google indexes, use specialized tools. Services like WhatsMyName.app or the command-line tool Sherlock rapidly check for the existence of a specific username across hundreds of websites. This can instantly reveal accounts on niche forums, gaming sites, or obscure social networks that would never appear in a standard search. * **Pattern Analysis:** People often use patterns. If the username is `jsmith85`, it's worth searching for `jsmith1985`, `johns85`, or `j_smith85`. Look for prefixes or suffixes that might be added or removed on different platforms (e.g., `_dev`, `_photos`). > **Pro-Tip: Contextualize the Username.** Don't just find the accounts; analyze where they are. A username active on GitHub, Stack Overflow, and a coding forum paints a very different picture than the same username on a car enthusiast forum and an e-commerce review site. The platform provides the context for the persona. ### The Email Address An email address is a direct, unique identifier and can be an incredibly powerful pivot point. * **The "Forgot Password" Technique:** Many websites will confirm whether an email address is registered with their service during the password reset process. By entering a target email into a site's "forgot password" form, you can often determine if an account exists. *Crucially, you should never complete the reset process*. The goal is simply to see if the system responds with "Password reset instructions sent" (confirming an account) versus "User not found" (confirming no account). * **Gravatar Lookup:** Many people use Gravatar (Globally Recognized Avatar) to link an avatar to their email address across multiple websites (like GitHub, WordPress blogs, etc.). By entering an email into a Gravatar lookup tool, you may be able to retrieve a profile picture, which can then be used for a reverse image search. This is a direct pivot to #Content-Hashing techniques. * **Breach Data:** Use services like Have I Been Pwned to check if the email address has appeared in any publicly documented data breaches. The value here is not just knowing they were breached, but that the breach data often includes the username associated with that email on a specific service, providing you with a new, verified username to investigate. * **Domain Analysis:** If the email uses a custom domain (e.g., `[email protected]`), this provides an immediate pivot point. You can then begin a full analysis of that domain using the methods discussed in the #Website-Infrastructure rambling. ### The Real Name A real name is often the most difficult starting point due to the high probability of multiple people sharing the same name. The key here is not to search for the name in isolation, but to narrow the search by combining it with other known data points. * **Scoped Searching:** Use search engine operators to limit the search. For example: `“John Smith” site:linkedin.com “Microsoft”` or `“Jane Doe” “University of Example” 2015`. Each additional piece of information—a company, a location, a school, an associated username—dramatically reduces the number of potential matches from millions to a manageable few. ## Layering the Analysis: From Accounts to Insights Once you have identified a collection of associated accounts, the real analysis begins. This is the process of layering data from different sources to build a holistic picture. * **The Social Graph:** Look at who the target interacts with. Who do they follow? Who follows them? Do the same friends or colleagues appear across multiple platforms? Mapping these connections can reveal organizational structures or personal relationships. * **Content as a Clue:** The content a person posts is a direct window into their activities, location, and interests. A photo posted to Twitter might contain visual clues that allow for a precise #Geolocation. A blog post might mention a specific hobby or skill. * **Look for Inconsistencies:** Does the professional persona on LinkedIn contradict the anonymous persona on Reddit? These inconsistencies can be just as revealing as the consistencies. ## The Importance of Corroboration A single data point is a lead, not a fact. The final and most critical step in any individual investigation is corroboration. Before concluding that two accounts belong to the same person, you should look for multiple, independent points of connection. For example, connecting a Twitter account to a GitHub account is a strong possibility if they share: 1. The same username. 2. The same profile picture. 3. A link to the same personal website in their bio. Having all three connections turns a possibility into a near-certainty. It is this process of multi-source verification that separates rigorous analysis from mere speculation. --- The goal of an individual investigation is not to find a single "secret" piece of information, but to patiently assemble a profile from dozens of public fragments. It’s a process of aggregation, pivoting, and, most importantly, verification. The result is not a trove of private data, but a verified mosaic built entirely from the digital trails people a person leaves behind.