A Free OSINT Lesson: To The Last Syllable of Recorded Time(line)
Want to be good at OSINT? Timelines.
“Tomorrow, and tomorrow, and tomorrow,
Creeps in this petty pace from day to day,
To the last syllable of recorded time…”
- Macbeth, Act 5, Scene 5.
When people ask why I love this weird job that I have, I usually say something dumb like, "Puzzles are fun to solve," "I've always had this inquisitive mind," or "It's the thrill of the chase."
To be honest, I can't explain what I do. Permanent Record Research isn't a PI firm, a due diligence firm, nor a forensic accounting company. We aren't an intelligence company, either. Sure, we do a lot of that work, but our niche is far more… niche.
Most of our clients hire us because they have an issue, and those issues range. The one uniting factor: they don't yet understand the scope or breadth of the problem. They have a sense that something is not right, that niggling feeling that something is looming, but they don't know what, and they hire us to work with them to understand what that is. They see Birnam Wood in the distance and want to know if it's coming to Dunsinane.
Behind all those fancy research, PI, and intelligence firms, their bravado and the vanity of their shiny technology, is one simple thing: time.
Everything is measured in time. Every single case hinges upon it.
So, when you strip away the layers of fun marketing, a shiny website, and some dude in a suit, it all boils down to something very simple.
“When.”
Now, listen, I love tools that make my job easier. Stuff like Darkside, Maltego, OSINT Industries, Forensic OSINT, Hunchly, Obsidian, Whatsmyname, shit, even Google Dorking... they all have their place in this world.
However, nothing beats a simple fucking spreadsheet and your brain’s natural ability to simply write shit down in chronological order.
You want to be good at OSINT?
‘Timeline’ every single fucking thing.
So this is real and something I’ve dealt with while working for a client. Yes, I’ve changed the details to protect them. Yes, they are OK with it.
At PRR, we love spreadsheets and timelines. Justin Seitz got me onto this wagon a couple years back. He’s a Jedi Master at Timelines. I’d like to think I’m a Jedi Knight… but I’m probably still a Padawan. His are all colour-coded, clean and shiny—I think he’s just vain. Mine look like text diarrhea.
Regardless, timelines work.
We had a client who’d heard rumours about a partner they recently brought into their firm. Let's say they became suspicious of a possible financial connection to another firm that was a known bad actor (lots of lawsuits, shady business practices, labour disputes, etc.).
We began to do research and found that between 2014 and late 2016, this new partner, we'll call her Beth, co-owned a small company with the founder of the “bad actor” firm, who we will call Roger. It was funded by US government technology grants, and was developing software to be used for "public good."
As we gathered information, we began generating a timeline for everything Beth had done leading up to this company and after, adding chronological points for when Roger showed up on the scene, and noting everything we could.
It became a massive beast of a spreadsheet. Yes, this work is tedious. Yes, I injected Coke Zero into my eyeballs. Were there points where I had pages of notes that I then had to insert into that timeline? Yep. It's fucking work. Thank the gods I did it, because it paid off.
A week or two later, we provided the report to our client, had a debrief session, and highlighted the fact that Beth and Roger knew one another and engaged in business together at one time.
We did raise a few other flags for them: This company basically went belly-up. The software seems to have vanished. Some staffing choices didn't make sense. The company continued to file reports with its state company's office until 2022, even though it seemed to cease operations in 2017. Together, this all pointed to weirdness, but nothing overtly illegal, fraudulent, or nefarious.
Our client was happy to have the information. They paid and put us on a totally separate task.
By the pricking of my thumbs, something wicked this way comes. Need to hire a firm like Permanent Record Research for a project? Send us a message.
Two or three months passed after the report was sent. Then, on an idle Thursday, an email hit my inbox like a bitter December wind. I can still recall how the Coke Zero tasted that afternoon. It was sweet and cold, like an outdoor winter kiss after you and your first crush have been playing street hockey outside all morning as teenagers.
My client decided to sue that other “bad actor” firm over an old deal that had gone south. I cannot go into details for obvious reasons. But, my client was sitting on this information, and that bad actor firm had launched a counter-suit. In America, you can sue anyone for anything, apparently.
The best part. Beth, that new partner, was named in the counter-suit. According to the claim, she approached that bad actor company, its owners, and Roger, asking for a loan back in early June of 2016. That loan was given to Beth on July 7th, 2016, via "an arms-length company." There were allegations about the money not being paid back. Beth said it was paid back via some other financial arrangement. It was a mess.
Dreams of winter kisses faded, and my Coke Zero turned into a bubbling, churning witch's brew. Birnam Wood was quickly moving towards Dunsinane. Something wicked was coming.
In a follow-up client call about 45 minutes after that email hit my inbox, I learned Beth stopped talking. She lawyered up separately from the firm. There was a general sense that someone wasn't telling the whole truth. Everyone was suing everyone. The client mentioned that Beth and Roger used to own a company together and wondered if the loan was somehow connected to that.
"Yeah. But Roger didn't start the company with her,” I said, over the phone. “He came in a bit later…holy shit…hold on…”
Now, I said the above sentence to my client over the phone because I assumed we were looking for a specific tree, and this wasn't it. That old Beth/Roger company was a dead duck and probably not related to the current issue. But, as you can see, via those telling ellipses, my mind hailed some ancient part of my brain that sees the world via sequential and chronological order. A petty pace that slowly crept into my mind.
"Uh, ok," was the response on the other end of the line. It was a chortled, quiet laugh.
I ran to my computer, found the old spreadsheet with the timeline, and looked at 2016.
Now, quick aside. I said above that you should timeline everything. This is why.
In my timeline, I had every single timestamp for that old Beth/Roger software company funded by US government grants. Dates of incorporation. Dates of filings. And yes, dates of changes to officers and directors.
I scrolled to July of 2016, the alleged month that Beth was issued a loan by an “arms-length company” that was somehow connected to Roger and his other firm.
And lo, there it was. No fancy technology. No fancy tools. No fancy suit. No fancy training.
Just a simple old “when.”
Beth approached Roger regarding the loan in June of 2016. According to the legal claim, that loan was given to Beth on July 7th, 2016. According to the state’s corporate registry documents, which I meticulously timelined, that old US grant-funded software firm designing programs to serve the “public good”... well, Roger was made an officer and director on July 5th, 2016 (and it became official a day later, which I also noted because the paperwork had to make its way through the state system).
Beth issued 49% of the company shares to Roger, and a couple of months later, in September of 2016 (also timelined), that company laid off its entire staff and ceased formal operations. Its last social media post occurred on September 12th, 2016 (you bet your ass I timelined that).
“Holy shit,” my client said as I explained over the phone.
“Oh God, we aren’t done,” I said.
Beth and Roger made a mistake. This little software firm looked like an innocent flower, to paraphrase Lady Macbeth, and they were actually the serpents underneath it.
Ostensibly, that company shuttered in September 2016. Yet, it kept filing corporate reports with the state government up until 2022.
“Why?” I asked my client over the phone. “Why keep filing with the state years after your company allegedly folded?”
There was a momentary pause. It was, at most, half a second. We have very smart clients.
“Oh fuck…”
As it turns out, using federal and state technology grants to finagle some sort of personal loan is frowned upon. I won't comment on who did what willingly, nor can I comment on how justice will be served. I'm not a lawyer.
But what I do know is that without that timeline of events nicely laid out into a spreadsheet, I probably would not have made the connection. I can recall, almost perfectly, during that client call, waiving off that software company connection. It was one of those half-baked thoughts that kinda sat there, and I probably would have begun looking for other possible deals between Beth and Roger, coming up empty and maybe returning to it in frustration a week or two later. I saved all that time by simply revisiting the work I had already done and saved my client a boatload of money by helping them right there and then.
As I said, all the fancy technology and coding and thought-leader bullshit have a place in the line of work. Mostly, it's full of sound and fury, and it signifies nothing.
For all you budding OSINT kids or even experts who have been doing this way longer than me, we all know this line of work isn't easy or simple. It's "bash your head against the wall" frustrating at times. And there are a lot of idiots out there who strut and fret their hour on this stage, and they rely on making things far more complicated than they often need to be.
What makes you good at this work is slowing down, detailing what happened when, and pausing to think. Let time be your weapon, whether you put it into a spreadsheet or walk off and take 20 minutes to drink a Coke and stare out your window.
The best part is that this isn't some big fancy skill you need to pay a company $9,000 to learn at a training conference. You just got to fucking do it.
Recognize that, much like Beth and Roger have, time is the fire in which we burn (I know, I know…not Shakespeare, but still a kick ass line from a great poem).