OSINT & Digital Investigations

About this course

Learn the foundations of open-source intelligence and digital investigations through practical, ethical exercises. Plan investigations, assess public sources, recognise infrastructure clues, protect sensitive information and produce clear, defensible reports. Designed for beginners in online fraud, trust and safety, abuse intelligence, and digital investigations. Educational training only. No unauthorised access, intrusive tracking or live-target exercises. Certificate of completion is not an accredited professional qualification.

What you will learn

• Translate a fraud or abuse allegation into a precise, appropriately scoped investigation plan
• Identify an appropriate legal and organisational basis for processing information
• Apply practical investigator-safety and data-minimisation safeguards
• Search, corroborate and document publicly accessible sources
• Interpret basic domain, DNS and infrastructure records without confusing shared infrastructure with common ownership
• Capture evidence with timestamps, provenance, integrity checks and an auditable evidence log
• Write an evidence-led report that separates facts, inferences and unknowns

Curriculum

17 of 17 lessons published.

1. Module 1 · 2 h 5 min

   Investigation foundations

   Defining questions, legal considerations and the intelligence cycle.

   1. What OSINT is and is notReading · 35 min
   2. The intelligence cycleReading · 35 min
   3. Legal and ethical considerationsReading · 40 min
   4. Module 1 knowledge checkAssessment · 15 min

2. Module 2 · 1 h 30 min

   Operational security

   Keeping yourself and your investigation safe.

   1. Threat modelling for investigatorsReading · 45 min
   2. Research environments and personasReading · 40 min
   3. Module 2 knowledge checkAssessment · 5 min

3. Module 3 · 2 h 35 min

   Searching and pivoting

   Finding and connecting information across sources.

   1. Advanced search techniquesReading · 50 min
   2. Usernames, emails and social platformsReading · 50 min
   3. Images, geolocation and metadataReading · 45 min
   4. Module 3 knowledge checkAssessment · 10 min

4. Module 4 · 2 h 15 min

   Infrastructure analysis

   Investigating domains, IP addresses and hosting.

   1. Domains, WHOIS and DNS historyReading · 55 min
   2. IP addresses and hosting providersReading · 55 min
   3. Module 4 knowledge checkAssessment · 25 min

5. Module 5 · 2 h 35 min

   Evidence and reporting

   Capturing, preserving and presenting findings.

   1. Capturing and preserving evidenceReading · 50 min
   2. Writing an investigation reportReading · 50 min
   3. Final assessment — ParcelDesk case studyAssessment · 55 min