Connecting OSINT and physical device forensics with Magnet Axiom
by Chad Gish
Key takeaways
- OSINT, or open-source intelligence, is information gathered from publicly available sources such as social media, websites, forums, and public records.
- Public information and physical device forensics are strongest when used together. OSINT can identify suspects, accounts, and locations early, and device evidence can then validate, expand, or challenge those findings.
- Investigators can often access OSINT before any other digital evidence, since it doesn’t depend on locating and lawfully acquiring a device or waiting on a provider.
- No single source of digital evidence tells the whole story. OSINT is one of six pillars alongside physical devices, cloud data, video, cell site information, and vehicle infotainment data, and the value comes from the connections between them.
Open-source intelligence, or OSINT, and physical device forensics work best when investigators use them together. Open-source intelligence can help identify suspects, accounts, aliases, locations, and relationships early in an investigation, while physical device evidence can help validate, expand, or challenge what was first found through publicly available information.
Over the years, I’ve come to think about digital evidence in terms of what I call the six pillars of digital forensics:
- Physical devices
- Video
- Cloud data
- OSINT
- Cell site information and call detail records (CDR)
- Vehicle infotainment data
Each pillar can provide valuable information on its own, but in my experience, the real power comes from understanding how those pillars work together. One source of digital evidence can create the lead that points investigators to another, and information from one pillar can help corroborate what was found in another.
In this article, I want to focus on two of those pillars, OSINT and physical devices, and how they can work together to help investigators develop leads, establish timelines, identify suspects, and build a stronger evidentiary picture.
Why physical devices aren’t always the first evidence available
When investigators think about digital evidence, physical devices are often one of the first things that come to mind. A suspect’s cellphone, computer, tablet, or other device can contain an incredible amount of information about that person’s activities, communications, relationships, movements, and interests. But there’s often a gap between knowing that evidence may exist and actually being able to examine it.
A device has to be located and lawfully acquired. A search warrant may need to be obtained. The device has to be preserved, extracted, and processed before an examiner can begin analyzing the information it contains. Cloud data can present similar challenges when investigators need legal process and have to wait for a provider to respond.
That is where OSINT can become particularly valuable.
What is OSINT in a digital forensics investigation?
Open-source intelligence (OSINT) is information collected from publicly available sources and analyzed to develop investigative intelligence. It can include publicly accessible social media accounts and posts, websites, photographs, videos, online forums, public records, usernames, geospatial data, aliases, and many other sources of information available on the internet. Social media is often the richest of these sources, and the subset of OSINT focused on it is called social media intelligence, or SOCMINT.
The important distinction is that OSINT is based on information that is publicly available. It does not mean hacking into an account, bypassing security, or obtaining information that requires unauthorized access.
For investigators, one of the greatest advantages of OSINT is that it can sometimes be available before other forms of digital evidence can be obtained.
That can be especially important early in a criminal investigation, when investigators may know that a person is involved but may not know the person’s real name, address, phone number, social media accounts, or even where that person lives. This is common in cases involving individuals who intentionally avoid using their real identifying information.
In those situations, investigators have to look at the information they do have and ask a simple question: What can I do with it?
Sometimes the answer is a nickname.
How OSINT can turn a nickname into an investigative lead
I experienced this firsthand during a homicide investigation where one of the only active investigative leads was a very unique nickname associated with the suspect.
That may not sound like much.
In a traditional investigation, a nickname can seem almost useless without a last name, address, date of birth, or other identifying information. But in this case, the nickname was unusual enough that it became the starting point for an OSINT investigation.
Using that nickname, I searched publicly available social media platforms. The nickname led to an account, the account led to a person, and that person turned out to be the suspect investigators were looking for. That discovery was important, but identifying the suspect was only the beginning. The real value came from continuing to follow the information and looking at the digital trail surrounding that individual.
Public information helped establish additional identifiers, including an address and other details that could be used to begin piecing together the suspect’s whereabouts before and after the homicide.
Individually, some of the information may not have seemed particularly significant. Taken together, however, it began to establish a timeline and provided information that was relevant to the homicide investigation.
That is one of the things I find most valuable about OSINT. The value is not always in finding one piece of information that solves the case. More often, it comes from finding multiple pieces of information and understanding how they relate to one another.
A nickname can lead to a social media account. A social media account can lead to an identity. An identity can lead to an address. An address can lead investigators to a physical device. Information from that device can then be compared with what was first discovered through OSINT.
That is where the pillars begin to connect.
How OSINT fits inside the digital evidence workflow
One thing I appreciate about today’s digital forensic environment is that OSINT does not have to exist as a completely separate investigative process. Public-facing information found online can become part of the broader digital evidence workflow.
Magnet Axiom’s cloud capabilities allow investigators to acquire and analyze publicly available information from supported social media platforms and incorporate that information into an Axiom case. Depending on the platform and current capabilities, this can include public-facing information from services such as Facebook, Instagram, and X.
For example, an investigator may start with a username or nickname. That information may lead to a public social media account, which can provide more context about the person, their relationships, activities, locations, or online presence. That public information can then be acquired through the appropriate Axiom cloud workflow and examined alongside other evidence in the same case environment.
This is the role Magnet Axiom plays. OSINT may help investigators find the thread, but Axiom helps them follow that thread across devices, accounts, artifacts, conversations, locations, and timelines. Instead of looking at public-facing information in one place and physical device evidence in another, investigators can bring those sources together, compare them, and begin building a more complete evidentiary picture.
OSINT does not replace physical device forensics
It’s important to make one thing clear: OSINT is not a replacement for physical device forensics, cloud data, cell site information, video, or the other pillars of digital evidence. It’s another source of evidence and investigative intelligence.
One of the biggest mistakes investigators can make is looking at these sources independently. Digital evidence rarely exists in a vacuum. A cellphone may contain information that points back to social media. A social media account may help identify a cellphone or other device. Video, cell site information, cloud data, and vehicle infotainment data may each provide another layer of context.
The individual pillars become much more valuable when investigators look for the connections between them. That is particularly true with OSINT and physical devices.
From OSINT to physical device evidence and back again
Once investigators have identified a suspect through OSINT, the investigation can change significantly. Instead of searching for an unknown person, investigators may now have a name, address, associated accounts, telephone number, vehicle information, or other identifiers. Those details can be used to develop additional investigative leads and, when appropriate, support the legal process necessary to obtain physical devices and other non-public digital evidence.
This is where the transition from OSINT to physical device evidence becomes important.
A smartphone can contain communications, photographs, browser history, application data, location-related artifacts, social media information, contacts, documents, and countless other pieces of information. A computer can provide an entirely different view of a person’s digital activity.
Using Magnet Graykey for mobile device extractions and Magnet Axiom for processing and analysis, investigators and forensic examiners can examine the data recovered from physical devices and place that information into the broader context of the investigation.
The question is no longer simply, “What’s on this phone?”
The better question is, “How does what’s on this phone relate to everything else we already know?”
Suppose OSINT establishes that a particular social media account belongs to a suspect. When a physical device is later examined, investigators may find that same account, username, email address, communications, photographs, or other artifacts on the device. What began as publicly available information can now be examined alongside forensic evidence recovered from the device. The reverse can also happen when a device examination reveals a username, email address, phone number, photograph, website, or other identifier that sends investigators back into additional OSINT research.
Connecting OSINT, mobile device forensics, and other digital evidence
This is also where forensic platforms become increasingly important. Modern investigations can involve enormous amounts of data from multiple sources, and acquiring the data is only the first step. Investigators have to process it, search it, understand it, and determine how individual artifacts relate to one another.
For example, imagine an investigator develops a suspect’s identity through OSINT. That information leads to a physical address and eventually to the seizure of a cellphone. The device is extracted with Graykey and processed in Axiom.
The examiner may find communications that establish relationships with other individuals, photographs that provide additional context, application artifacts that establish activity, and other information that helps build a timeline.
That information can then be compared with the OSINT that initially identified the suspect. If the investigation also involves video, cell site information, vehicle infotainment data, or cloud records, those sources can be evaluated against the same timeline.
Suddenly, investigators are no longer looking at isolated pieces of digital evidence. They are looking at corroborating evidence from multiple pillars.
Explaining OSINT and device evidence in the courtroom
Finding information is only part of the investigation. Investigators also need to explain where the information came from, how it was obtained and preserved, and why it should be considered reliable.
That applies to OSINT just as much as physical device evidence. With OSINT, investigators should be prepared to explain the source of the information, how it was attributed to a person or account, when it was collected, and how it was preserved. Publicly available information can still be inaccurate, misleading, impersonated, or difficult to attribute, so those issues need to be considered early.
Physical device evidence carries its own requirements. Investigators and examiners must be able to explain the legal authority, extraction process, tools used, artifacts recovered, and how those artifacts were interpreted. The strongest digital evidence is often the evidence that can be corroborated by another source.
A social media post, cellphone artifact, video clip, cloud record, cell site record, or vehicle infotainment artifact may each tell part of the story. When those sources independently support the same conclusion, the evidentiary picture becomes stronger and easier to explain.
The six pillars are stronger together
Technology continues to change the way people communicate, travel, work, and interact with the world around them. As a result, investigators have more potential sources of digital evidence than ever before. The challenge is recognizing where that evidence exists and understanding how the different sources can work together.
That is why I continue to look at digital evidence through the lens of the six pillars.
OSINT may be the first pillar an investigator can access. A physical device may provide the most detailed view of an individual’s digital activity. Cloud data may fill in information that is missing from the device. Video may corroborate a location or activity. Cell site information may help establish where a device was during a particular period. Vehicle infotainment data may provide another independent source of location and activity information.
No single pillar necessarily tells the entire story.
When investigators learn to move between the pillars, the individual pieces of information begin to make more sense.
That homicide investigation started with something that, on its face, did not appear to be much: a nickname. That nickname led to OSINT. OSINT led to an identity. The identity led to an address and additional information about the suspect. From there, the investigation could continue into the other pillars of digital evidence.
That is the lesson I continue to take from these investigations: don’t underestimate the value of the first piece of information you have, no matter how insignificant it may seem.
In today’s digital environment, a nickname, username, photograph, or public social media post may be the first piece of information that moves an investigation forward. The real value comes from what investigators do next: validating that lead, connecting it to other sources of evidence, and building a timeline that can be clearly explained. Magnet Axiom helps investigators bring OSINT, physical device evidence, cloud data, communications, media, and timelines together so they can move from a single lead to a stronger, more complete case.
Frequently asked questions
OSINT, or open-source intelligence, is publicly available information investigators use to develop leads, identify people or accounts, and add context to a digital investigation.
OSINT can identify a suspect, username, phone number, address, or account that helps investigators pursue and examine a physical device. Device artifacts can then be compared with the original OSINT findings.
Magnet Axiom helps investigators process, search, analyze, and connect OSINT, mobile device data, computer artifacts, cloud evidence, communications, media, and timelines in one case.
Corroborating OSINT, physical devices, cloud data, video, cell site information, and vehicle infotainment data helps investigators build a clearer, stronger, and more defensible timeline.
About the author
Chad Gish, Senior Principal Forensic Specialist at Magnet Forensics, is a retired police detective with more than 25 years of experience investigating homicides, mass casualty events, and crimes against children. He is a recognized expert in digital forensics, playing a key role in high-profile cases and the development of forensic labs and crime centers.