Glossary of open source investigation

The vocabulary of open source investigation shifts from one profession to another. Here are the terms that keep coming up, defined plainly, grouped by use.

The objects on a map

Entity

An object in the real world placed on the map: a person, a company, a domain, an address, a document. Every entity carries a kind, and the kind determines which fields mean something for it.

Entity kind

The nature of the object. It does not merely colour the map: it decides which fields are offered. A domain calls for a host and a creation date, a person calls for a name and a nationality.

Field

A piece of information carried by an entity: a legal name, a registration number, a date. It is also where the source and the date of consultation belong.

Link

The relationship between two entities. It carries a name, often a direction, sometimes a date. An unnamed link teaches nothing to whoever reads the map back.

Link kind

What the link asserts: controls, owns, employed by, in contact with, located at, registered to. It is the element that turns a drawing into a verifiable statement.

Graph

The mathematical form behind a map: a set of points and lines. The word is useful for talking about properties of the structure, such as one point concentrating many links.

Hub

An entity concentrating an unusual number of links. Often the pivot of a file, sometimes merely an artefact of collection.

Cluster

A group of entities more connected to each other than to the rest of the map. A layout that pulls linked entities together brings them out by itself.

The approach

OSINT

Open source intelligence. Collecting, cross-checking and interpreting information reachable without circumventing any protection. The dedicated guide sets out what the term covers and what it does not.

Open source

A source reachable without special authorisation or circumvention. It may be paid for. What counts is the mode of access, not the price.

Pivot

A piece of information that lets you move from one entity to another: an email address present on two sites, a postal address shared by two companies, a handle reused across platforms. Pivoting means advancing one step in the investigation.

Cross-check

Confirming a piece of information through an independent source. Two pages copying each other do not make two sources.

Converging evidence

A set of elements which, taken individually, prove nothing, but which converge enough to found a conclusion. The expression comes from legal vocabulary.

Digital footprint

The whole set of traces a person or an organisation leaves online: domains, accounts, publications, mentions by third parties.

Chain of provenance

The ability to trace every claim back to its original source, with its date. It is what lets someone else replay your reasoning.

Competing hypothesis

An alternative explanation of the same facts. Stating them explicitly and looking for what eliminates them is the simplest method for avoiding seeing only what you set out to find.

Registers and documents

Company register

The public directory of a country’s businesses, with their officers, registered offices and articles of association. A first-hand source, dated and enforceable.

Registration extract

The document attesting that a company exists and summarising its situation on a given date. In France this is known as an extrait Kbis for commercial companies.

Beneficial owner

The natural person who genuinely controls a company, beyond the intermediate entities. Often the very object of an investigation into an arrangement.

Legal notice

A publication required at certain moments in a company’s life: incorporation, change of director, transfer of registered office, dissolution. Useful for dating a change precisely.

Shell company

A structure with no real activity, used to place a screen between an activity and the person behind it. Often spotted through converging signs: shared address, director holding many mandates, no employees.

Technical traces

Domain name

The text address of a site. Its creation date, its registrar and its host are attachment points that often get overlooked.

Registrar

The organisation through which a domain name is booked.

Domain lookup

The service reporting on a domain name’s registration, historically known as whois. Information about natural persons is now largely masked in Europe.

IP address

The numeric identifier of a machine on a network. Two sites hosted at the same address may simply share a provider without any connection between them: it is weak evidence, to be handled carefully.

Certificate

The document authenticating a site over HTTPS. Public certificate logs allow you to discover subdomains that appear nowhere else.

Page archive

A dated copy of a web page, kept by an archiving service. It lets you prove what a site displayed on a given date, including after it was changed.

File metadata

Information attached to a document beyond its content: author, software, creation date, sometimes coordinates. Worth checking systematically on the material you obtain.

Framework and precautions

Personal data

Any information relating to an identifiable natural person, directly or indirectly. Public information remains personal data. See the guide on personal data.

Minimisation

The principle that you only collect what is necessary for the purpose pursued. It makes the file legally sounder, and more readable.

Retention period

The deadline after which a piece of data must be deleted or archived. It is set before collection, not when clearing out.

Reversibility

The ability to recover your work in a form usable elsewhere. The first criterion to check before trusting a tool with an investigation, as set out in the guide on choosing a tool.