Outcome: Define OSINT, distinguish public availability from unrestricted use, and apply purpose, authority, privacy, platform, safety, and escalation controls.

Case: A student team is asked to investigate a fictional fraud lead, but the request has no defined purpose, collection limit, protected-person rule, retention period, or approval for contact with subjects.

Tools: Purpose-and-authority gate, Harm assessment, Collection boundary record

Outcome: Design repeatable searches across web indexes, archives, official records, documents, languages, names, and time while controlling source and collection risk.

Case: A fictional charity appears under several names across old websites, government notices, archived pages, and translated documents, producing contradictory search results.

Tools: Query decomposition sheet, Archive comparison, Search reproducibility log

Outcome: Evaluate source credibility and information reliability, triangulate claims, verify time and context, preserve provenance, and express uncertainty objectively.

Case: A viral image, an anonymous post, and a copied news article all repeat the same claim, creating the appearance of three sources although they share one origin.

Tools: Source-quality matrix, Claim-evidence table, Provenance record

Outcome: Resolve entities safely, analyze aliases and relationships, use organizational records, avoid identity harm, and separate legitimate verification from intrusion or deception.

Case: Two fictional professionals share a name, employer sector, and city; one is wrongly linked to a controversial account because the team skips disambiguation.

Tools: Entity-resolution matrix, Relationship chart, Misidentification risk review

Outcome: Use passive registration, DNS, IP, ASN, certificate, hosting, web, and repository evidence to form bounded infrastructure hypotheses without active scanning.

Case: A fictional brand uses a primary domain, a cloud-hosted application, a CDN, several certificates, and an abandoned repository; the team must map ownership without touching live systems actively.

Tools: RDAP record worksheet, Passive infrastructure map, Ownership confidence matrix

Outcome: Collect social and multimedia information proportionately, restore context, verify images and video, interpret metadata carefully, and preserve ethical evidence packages.

Case: A fictional incident is documented by reposted images, shortened clips, deleted posts, and conflicting captions across several platforms.

Tools: Post context record, Image-verification worksheet, Video verification timeline

Outcome: Evaluate location and time claims using maps, imagery, terrain, landmarks, weather, sun, routes, and uncertainty while protecting sensitive locations.

Case: A synthetic photograph is claimed to show a recent event in one city, but signs, shadows, weather, road geometry, and skyline features point to several possibilities.

Tools: Geolocation evidence grid, Chronolocation timeline, Sensitive-location review

Outcome: Normalize and correlate OSINT, avoid bias and causal overreach, communicate confidence, write evidence-based findings, and deliver reproducible decision support.

Case: A fictional investigation has hundreds of rows, duplicated entities, conflicting dates, and attractive relationship diagrams, but no source-quality fields or clear answer to the requirement.

Tools: Normalization worksheet, Competing-hypotheses matrix, Decision-ready report

Outcome: Protect researchers and evidence, use safe research environments, manage files and links, collaborate with review controls, and complete a bounded end-to-end OSINT capstone.

Case: A team must assess a fictional scholarship-portal impersonation campaign using a supplied offline evidence pack without contacting subjects, visiting risky live infrastructure, or exposing victim data.

Tools: Researcher threat model, Evidence security checklist, Capstone intelligence report