Ebooks
Free ebooks that paid courses are built on
Free does not mean lightweight. The evidence protocols, analysis methods, and verification handbooks most training quietly draws from are public PDFs. These are the ones worth your time, and what has aged in each.
Before you choose
How to read free ebooks without wasting a week
- 01
Read for method, skim for tools
Tool lists in a PDF from 2018 are mostly dead. The sections on process, evidence, and reasoning are usually still right.
- 02
Check who published it and why
A protocol from a court-facing body and a handbook from a training company have different goals. Both can be excellent; read them differently.
- 03
Pair a thinking text with a doing text
Analysis methods without practice stay abstract. Read one alongside a hands-on course or a CTF.
Quick picks
If you only read one
Read first, whatever your job
ReadPsychology of Intelligence Analysis
The clearest account of how analysts fool themselves, and still free.
If your findings may end up in court
ReadBerkeley Protocol on Digital Open Source Investigations
The international standard for open-source evidence.
For newsrooms and fact-checkers
ReadVerification Handbook
Practical verification from working journalists.
For a map of the tool landscape
ReadOSINT Tools and Resources Handbook
Broad categorised tool list, best read as a taxonomy.
Side by side
Every ebook at a glance
Cost is a model, not a price. Time is the commitment before it pays off. Updated is the latest edition or issue we could verify.
| Resource | Cost | Level | Time | Updated | Pages | License |
|---|---|---|---|---|---|---|
| Psychology of Intelligence AnalysisRichards J. Heuer Jr., CIA Center for the Study of Intelligence FreeAll levelsArchived | Free | All levels | Days214 pages. A week of evenings, slower than the page count suggests. | 1999 edition; PDF last revised 2020 | 214 | Educational copies permitted; no commercial use |
| Berkeley Protocol on Digital Open Source InvestigationsUnited Nations Human Rights Office and UC Berkeley Human Rights Center | Free | Intermediate | Days102 pages. Two or three sittings, then a lifetime of referring back. | 2022 edition; advance version 2020 | 102 | UN copyright, free to download |
| Verification HandbookEuropean Journalism Centre, edited by Craig Silverman | Free | All levels | DaysEach edition is a long weekend. | Third edition 2020 | Three editions; counts not published | Not stated |
| A Tradecraft Primer: Structured Analytic TechniquesUS Government, CIA Center for the Study of Intelligence FreeAll levelsArchived | Free | All levels | Hours45 pages. One evening. | March 2009 | 45 | US Government work |
| OSINT Tools and Resources Handbooki-intelligence, Chris Pallaris and team | Free | Beginner | HoursSkim the categories in an evening. Nobody reads a link directory cover to cover. | 2025 web edition; last PDF 2018 | 327 in the 2018 PDF | CC BY for the PDF; CC BY-NC for the website |
| Bellingcat Online Investigations Toolkit and GuidesBellingcat and volunteer maintainers | Free | All levels | MinutesMinutes to find a tool; an hour per guide. | Toolkit launched September 2024; guides through mid-2026 | Online, 12 categories | Not stated |
| Exposing the Invisible: The KitTactical Tech | Free | Beginner | DaysA guide per evening; the whole Kit over a month. | Launched 2019; guides added through the 2020s | Online; booklet about 96 pages | CC BY-SA 4.0 |
| GIJN Reporter's Guide to Investigating Digital ThreatsGlobal Investigative Journalism Network, with Craig Silverman | Free | Intermediate | HoursAn evening for the whole guide. | September 2023 | Online, 5 chapters | Not stated |
| Video as Evidence Field GuideWITNESS | Free | All levels | HoursAn afternoon for the core sections. | 2016 compilation; field notes added through 2023 | Section PDFs; compilation length not published | Creative Commons, variant stated inconsistently |
| First Draft Essential GuidesFirst Draft, closed 2022 FreeBeginnerArchived | Free | Beginner | HoursAn hour per guide. | 2019 to 2021; organisation closed 2022 | Short booklets; counts not verified | Not stated |
| A Field Guide to Fake News and Other Information DisordersPublic Data Lab, edited by Liliana Bounegru, Jonathan Gray, Tommaso Venturini, and Michele Mauri FreeAdvancedArchived | Free | Advanced | DaysA week to read; longer to attempt the recipes. | January 2018 | Not verified; the PDF is 93 MB | CC BY 4.0 |
| NATO Open Source Intelligence Handbook and ReaderNATO SACLANT, 2001 and 2002 FreeAll levelsArchived | Free | All levels | HoursAn afternoon for the handbook; the reader is for dipping into. | 2001 and 2002 | 57 and 110 | None stated |
| US Army ATP 2-22.9: Open-Source IntelligenceHeadquarters, Department of the Army FreeAll levelsArchived | Free | All levels | HoursAn afternoon. | 2012 public edition; current doctrine renumbered 2023 | Not verified | US Government work |
FAQ
Questions, answered
Are these really free, or is there a sign-up wall?
Each entry says. Most are direct PDF downloads from the publishing organisation. Where a form stands in the way, the entry notes it.
Why list a handbook from 2001?
Because the parts about the intelligence cycle, source evaluation, and reporting have not changed, and the entry tells you which parts have.
Can I share these inside my team?
Check the license on each entry. Several are public domain or openly licensed and can be dropped into a team wiki; others allow personal use only.
Learned the method? Practise it on real data
The resources above teach the craft. When you want to run real lookups across breach, people, domain, and crypto sources without opening a dozen vendor accounts, that is what SearchIn is for.
- Free account, no card
- Credits never expire
- Refund unused balance in 7 days