Practice 05 · of eight
Digital & open-source intelligence
Lawful collection, preservation and analysis of public digital information relevant to identity, relationships, conduct, events, threats and reputation — with defensible collection records.
- Instructed byAny client type
- Typical duration3–10 days
- Commercial basisScoped collection
- Tested byCourt, regulator, adviser
Questions this practice answers
Clients rarely arrive with a service in mind.
- What is publicly discoverable about this subject?
- Can this content be preserved defensibly before it disappears?
- Are these accounts connected to one person?
- What does the public timeline show?
What the work involves
Within the ten-stage process.
- Stages 01–03
Collection scope
What may lawfully be collected, from which sources, and what is out of bounds.
- Stage 05
Collection & preservation
Capture with hashes, timestamps and a collection log — no interaction with the subject.
- Stage 05
Analysis
Account correlation, geolocation review and timeline construction, kept separate from inference.
- Stage 07
Handover
Preserved set delivered with logs so a third party can audit how it was obtained.
Deliverable
What you receive.
A preserved evidence set with hash records, collection log and an analytical summary that labels inference as inference.
- Analytical summaryPrimary
- Collection logAnnexure
- Preserved capturesEvidence
- OSINT collection
- Forensic preservation
- Account correlation
- Geolocation review
- Timeline analysis
Limits of this practice
What this work is not.
- Public sources only
- No account access or credential use
- No bypassing of privacy controls
- No engagement with the subject under false identity
Often combined with
Most matters draw on three or four practices.
Confidential enquiries
Start with the question, not the method.
We assess the concern, lawful purpose and available information before recommending a scope.
Request a confidential consultation