Book
OSINT Techniques
Michael Bazzell, IntelTechniques
The broadest current field manual: 590 pages on building an investigation machine, searching every major platform and identifier, and working breach data. Buy the latest edition and expect it to age.
Formerly titled Open Source Intelligence Techniques, this self-published manual is in its 11th edition as of November 2024 and the author says no further edition is planned. It is organised in four sections: OSINT virtual machines, resources and techniques, leaks and breaches, and a short methodology section. It is the book most working investigators own, and the one most likely to be out of date in places by the time you read it.
Worth it if
- You want one reference that covers people, platforms, infrastructure, and breach data
- You are willing to build and maintain a Linux virtual machine for investigation work
- You run cases and need a technique inventory to reach for, not theory
- Your team needs a shared baseline that university and agency courses already use
Skip it if
- You want to learn analysis, reporting, or evidence standards; methodology is three chapters out of 47
- You are not comfortable with Linux and a terminal, and do not intend to become so
- You are buying a secondhand earlier edition; tool links and platform steps will be dead
What is inside
- 01
Section I: OSINT virtual machines, chapters 1 to 16
Why a VM; host setup for macOS, Linux, and Windows; the OSINT VM operating system; browsers, applications, scripts, APIs, maintenance, an automated build, Android virtualisation, and custom search tools.
- 02
Section II: Resources and techniques, chapters 17 to 35
Search engines; Facebook, X, Instagram, TikTok; online communities; email addresses; usernames; people search engines; phone numbers; maps; documents; images; videos; broadcast streams; domains; IP addresses; government and business records; virtual currencies.
- 03
Section III: Leaks, breaches, logs, and ransomware, chapters 36 to 44
Why breach data matters, hardware and software setup, terminal commands, data leaks, breaches, stealer logs, ransomware, and scripts, databases, and backups. This folds in a former separate supplement.
- 04
Section IV: Methodology, chapters 45 to 47
Methodology and workflow, documentation and reporting, policy, ethics, and development.
- 05
Companion material
Updated custom search tools, Linux scripts that build the VM, cheat sheets, and an online portal with credentials printed in the book.
What you will be able to do
- Build a dedicated investigation VM with the author's tools and keep it updated
- Work one identifier type at a time, email to username to phone, across the major platforms
- Query and correlate breach and stealer-log data locally
- Document a case well enough to hand it to someone else
How current it is
The 11th edition is the most current manual listed here, with about a fifth new and a fifth refreshed over the 10th. Platform-specific steps still drift within months, which the author mitigates with online tool updates. The author says no new edition is planned, so treat 2024 as the high-water mark and lean on the update portal and the author's blog afterwards.
- Updated
- 11th edition, November 2024
- Maintained
- Updated now and then
How to get the most from it
- 01
Build the environment before you chase anyone
Section I exists for a reason. A clean machine with the author's tools makes every later chapter faster and safer.
- 02
Read Section IV first, then go back
The methodology chapters are short and come last, but they tell you how to use the other 44 chapters without drowning.
- 03
Work one chapter per case type
When a case gives you an email, read the email chapter and run it. Breadth is the book's strength; sequence is your job.
- 04
Check the portal when a step fails
Platform menus change. The update portal and the IntelTechniques blog carry corrections between editions.
Strengths
- Unmatched breadth across the whole desk
- Tool scripts and a VM build that save real hours
- Breach and stealer-log workflows most books avoid
- Used as a set text by courses and academies
Limitations
- Goes stale quickly where it is most specific
- Thin on analysis, evidence standards, and ethics
- Assumes Linux comfort
- US-centric examples; adapt for other jurisdictions
Pair it with
- ReadBookPaidBeginner
Deep Dive: Exploring the Real-world Value of Open Source Intelligence
The methodology-first companion this manual is light on.
- ReadBookPaidIntermediate
Extreme Privacy: What It Takes to Disappear
The same author on protecting yourself, which investigators neglect.
- ReadCoursePaidAll levels
IntelTechniques Online OSINT Training
The video version, if you want the same material with monthly updates.
- ReadEbookFreeIntermediate
Berkeley Protocol on Digital Open Source Investigations
The evidence standard the methodology chapters gesture at.
FAQ
Questions, answered
Is this the same as Open Source Intelligence Techniques?
Yes. The series was renamed OSINT Techniques in recent editions. Same author, same lineage, now in its 11th edition.
Should I buy print or PDF?
PDF if you will copy commands and URLs; it is watermarked with your email and sales are final. Print if you want it on the desk. Print buyers get the online portal but not a free PDF.
Will there be a 12th edition?
The publisher page says there are no plans for one. Updates arrive through the online portal, tool downloads, and the author's blog.
Learned the method? Practise it on real data
The resources above teach the craft. When you want to run real lookups across breach, people, domain, and crypto sources without opening a dozen vendor accounts, that is what SearchIn is for.
- Free account, no card
- Credits never expire
- Refund unused balance in 7 days