A working console for the investigation lifecycle, from collection through analysis to a documented report. Open-source and public tooling, no license required to run. Findings are corroborated across independent sources and delivered with sourcing and collection dates.
Map a subject's public infrastructure and digital footprint: domains, subdomains, hosting, exposed services, archived content, and file metadata.
Verify a digital identity by pivoting on username, email, and phone across public platforms. Confirms whether accounts and contact points exist and connect.
Verifying an individual is different from investigating one. Confirm you have a lawful basis and any required license before building a profile of a person.
Assess breach and dark-web exposure for a subject: known data breaches, infostealer logs, and mentions on Tor-indexed sources.
These sources surface compromised data. Use it to assess exposure, not to exploit it. Do not access, download, or act on illicitly obtained credentials or content.
Court, property, business, and criminal records through directories that route to official government sources.
Public-records use for employment, credit, housing, or insurance decisions is a consumer report under the FCRA and carries legal obligations. Verify record currency at the originating authority.
Registration, ownership, filings, and screening. Confirm every screening hit against the original issuing authority before it enters a report.
Map corporate structure and shell-company risk indicators: layered ownership, formation-agent clustering, shared addresses, and high-secrecy jurisdictions. Deliverable is structure and risk flags, not investigation of the individuals behind them.
Blockchain and financial tracing: follow crypto flows across explorers, cluster wallets, and check addresses against abuse and sanctions data.
Establish whether an image or video is authentic, when it was taken, and where. Metadata extraction, reverse search, shadow-based chronolocation, and street-level confirmation.
A defensible geolocation rests on at least three independent visual anchors that agree. Report a confidence level, never an absolute claim. Do not use these methods to locate private residences or track individuals.
Vessel and aircraft movement for sanctions, trade, and asset matters. Ownership records behind a ship often lead directly into corporate structure work.
AIS and ADS-B show only what is broadcasting. Transponders can be switched off or spoofed, and a coverage gap during a sensitive period is itself a finding worth documenting.
Turn collected findings into structure and preserve them before they change. Link analysis, network visualization, and archival capture with chain-of-custody discipline.
Self-hosted digital forensics and e-discovery so evidence stays in your environment. Covers collection, processing, and review. Neither produces Bates-stamped court productions.
Policy drafting and GRC lifecycle tracking for readiness work. Basis for actionable policies and SOC 2 readiness, not certification.
Prebuilt search queries. Enter a selector above, then copy the query or open it directly. Match the query type to the selector.
Commercial platforms worth acquiring as the practice grows. Listed for planning, not currently in use. Each entry notes what it adds over the free stack and what it costs.
Most records platforms here run on credit-header data and are gated: they require a documented permissible purpose under GLBA and DPPA, a PI license in most states, and vetting before an account is issued. Subscribing does not by itself confer the right to search a person. Hunchly, Maltego, PitchBook, and the blockchain platforms carry no such gate.
Curated directories and community resources for finding the right tool or technique. Vetted starting points, not exhaustive dumps.
A source log built from this session: the subject, tools opened, queries run, and notes. Nothing is saved between sessions, so export before you leave.
Scoped, fixed-fee engagements for organizations. We investigate companies and their corporate relationships. We do not investigate individuals.
We verify an entity and map the structure behind it: registration, ownership, filings, sanctions exposure, and shell-company risk indicators such as layered ownership, formation-agent clustering, and high-secrecy jurisdictions.
Federal beneficial-ownership reporting was substantially rolled back for domestically formed US companies in 2025 and the rules remain unsettled. Where a definitive ownership record does not exist, we say so and rely on registry evidence and corroborated inference.
We assess an organization's exposure: appearance in known data breaches, infostealer-log presence, exposed infrastructure and services, and dark-web mentions.
Assessment only. We report exposure and recommend remediation. We do not access or act on compromised data.
We support electronic discovery through the processing, analysis, and review stages of the EDRM. We extract text and metadata, build a searchable review set, and document the collection defensibly. Self-hosted tooling keeps data in the client's environment.
We do not generate Bates-stamped productions.
We assess whether an image or video is what it claims to be. Metadata extraction, reverse-image analysis to establish first appearance, shadow-based chronolocation, and geolocation confirmed against street-level and satellite imagery.
We report a confidence level supported by independent visual anchors. We do not certify authenticity absolutely, and we do not geolocate private residences or track individuals.
We track vessel and aircraft movement for sanctions, trade, and asset matters using AIS and ADS-B data, then tie registered ownership and management back to corporate structures.
Transponders can be disabled or spoofed. We document coverage gaps as findings rather than treating absence of data as absence of activity.
We help organizations prepare for compliance frameworks, with a focus on SOC 2 readiness. We draft actionable policies, build a control inventory, and track remediation.
This is readiness work. We prepare an organization for audit. We do not issue certifications or act as an auditor.
Tell us what you need scoped. We respond within one business day with clarifying questions or a fixed quote. Do not include confidential case details, privileged material, or personal data in this form. We will establish a secure channel before you send anything sensitive.