OSINT Tips: Investigating Closed Profiles

Social media investigations involve checking many accounts to extract valuable evidence. Unsurprisingly, not every profile is accessible due to privacy reasons. As OSINT deals with publicly accessible data, many would assume that the inquiry stops there. However, everything visible on a closed account is still in the domain of open sources. So, instead of giving up, specialists can look into more advanced techniques to expand their investigations.

In this article we created together with the Social Links’ Center of Excellence, we’re uncovering real-world OSINT tips on dealing with closed social media profiles. The following are five handy tricks demonstrated in Social Links’ flagship solution SL Professional. With the help of these techniques, it’s possible to extend research, find non-obvious clues, and save a stuck investigation.

Let’s dive in!

OSINT Tip #1: Search by Profile Picture

The presence of profile pictures is a common sight on social media accounts. Even if the page is closed to the public, chances are there is a photo with a discernible face. When confronted with private profiles, investigators can turn to Social Links' image-based search and facial recognition transforms—Image Reverse Search, Image Search on Google, and Search by Face and Alias/Name. These functions enable analysts to see if the subject appears on any other social media platform with public access.

How It Works

Imagine we only have a Skype account with the name Carlos Garcia and a user picture to start our investigation. We need to find another profile that belongs to Carlos. So we run the [LinkedIn] Search by Face and Name transform to get his LinkedIn page. Search by Face and Name requires both elements to work. So, once we have Carlos Garcia’s LinkedIn, we can go deeper with our investigation.

OSINT Tip #2: Search by Alias

Many people prefer to use aliases online. The good news is that these usernames are like Internet names for people, meaning they might be used (usually unchanged) across several profiles. This is convenient for investigators because there are transforms that search whether the alias appears on any other platform, such as [Alias] Search in Sources, [Google] Search, [Steam] Search. After successfully locating the profiles, the next transforms—[Skype] Get Profile, [Snapchat] Get Profile, [Telegram] Get Profile,[TikTok] Get Profile, [Twitter] Get Profile—retrieve the exact matches.

How It Works

Let’s say that we have a closed profile with just an alias derekswims and no user picture, and we’re looking to find more information on this person. Using the transforms we mentioned above, we can look through other social networking platforms to see if any of them have a page with the username derekswims. Once we have a match (or several), we can check the account we found and run facial recognition transforms to see if other pages match.

OSINT Tip #3: Search by Bio Information

The bio of a profile refers to the text area where people can write something about themselves or link to other platforms that they use. Such data is usually publicly accessible, even if the account is closed. With SL Professional's transforms like [Instagram] Get Details or [Extract] Entities from Bio, About, Description, it’s possible to extract additional information and expand the scope of the investigation.

How It Works

For example, we need to find information on a closed account, but the only usable data is in the bio. We can start our investigation with the [Extract] Entities from Bio, About, Description transform, which gives us an email address and a separate Instagram profile. We can expand the search with the second account's alias first by running [Instagram] Get Details to get more information on the account, then [Alias] Search in Sources transform. Then, we can use the email address to see if we find matches with platforms such as Skype, Google (provided the service provider is Gmail, as the email extension doesn’t matter in this case), etc.

OSINT Tip #4: Search by Name and Surname Combination

Sometimes, experts find a closed profile that only displays a name and a surname combination as an alias. Investigators can easily enrich their inquiries with SL Professional’s powerful search transforms—[Alias] Search in Sources, [Google] Search, and [SL ISE] Search. After the search is complete, [Twitter] Get Profile can retrieve the exact match of the profile. The SL ISE (Social Links Identity Search Engine) functionality, in particular, allows specialists to match information fragments based on people’s digital footprints (traces that accumulate due to regular online activity).

How It Works

In our example, we only have a private account tamararitter with a handle that looks like the name Tamara and surname Ritter combination. To get further information about the profile, we run the [Alias] Search in Sources transform, which returns a Twitter account. Combining the available information with the [SL ISE] Search transform lets us get the subject’s email address, location data, and more.

OSINT Tip #5: Search by Recovery Information

Last but not least, when all other attempts fail, we still have one more option to try: the account recovery information. Companies never give out the full email address; however, a censored form which usually shows a couple of letters, is public information. This tip involves using fragments of data to connect to the larger puzzle. So, this technique involves making a grounded, educated guess based on available information.

How It Works

For example, we need to investigate a Skype account with little information besides the username forrest21. As our first step, we use the [Skype] Get Info from Password Recovery Page transform. The result is two censored email addresses and a phone number. Comparing the email accounts with the alias allows us to deduce that the handle is either the subject's name or surname. The next step involves looking for the nickname in other sources or trying to see if there are any matches in the SL ISE.

And that concludes our OSINT tips for investigating closed profiles. We hope you discovered new techniques and saw how effective SL Professional can be even when investigations seem stuck.