Source: thomasdishaw.com and intelcaster.com
Hashtagify enables investigators to analyze any Twitter hashtag.
Bitmessage-Send peer-to-peer messages similar to email but without the many spy filters between sender and receiver.
Advangle is a simple and convenient builder of complex web-search queries through Google or Bing search engines. You can save your queries in a free Advangle account to refer to later.
Bing vs Google-A tool that provides a side-by-side list and comparison of search results delivered through Bing vs. Google search engines.
iSeek-A targeted discovery tool that allows an investigator to enhance, analyze and organize searches, and see how collected information on a topic is distributed. iSeek uses natural language queries that understands the meaning and concepts embedded in the search and delivers relevant information.
Yippy (formerly Clusty) is a metasearch engine that allows investigators to index and federate documents and data sources to provide relevant big picture insights.
NerdyData-With NerdyData investigators can search for source code. The platform allows investigators to search for web technologies, advertising tags, meta descriptions and for any pattern that they want to identify on a website’s code.
PublicWWW-Allows investigators to search the source code and find related websites through the unique HTML codes they share such as widgets and publisher IDs.
Snapchat Leaks-Investigators can use this tool to find out if a Subject’s Snapchat username and phone number was released during a December 31, 2013 Snapchat database hack.
User Name Search
Namech_k– A tool that helps investigators find an available user name. This is a useful tool to use when setting up investigative online and social media personas.
Usersearch-A tool to find the person behind a username, email address or phone number.
Namecheckr-Allows investigators to check domain and social username availability across multiple networks.
Pipl-Investigators can use Pipl to find the person behind the email address, social username or phone number.
User Sherlock-A tool to help investigators determine the identity of the owner of an unknown username in their inbox, social network or online auction site.
KnowEm-Allows investigators to check the use of a brand, product, personal name or user name on over 500 social media websites.
Cars, Ships and Planes
VINCHECK-Investigators can use this tool to find out if a vehicle has been reported as stolen, but not recovered, or has been reported as a salvage vehicle.
Checkthatvin-Investigators can use this tool to know a vehicle’s title history, brand information and if it was ever junked, salvaged or declared a total loss.
Vin.Place-This site provides investigators with free access to vehicle purchase records data.
ReverseGenie-This tool allows investigators to conduct license plat searches to find owner and vehicle information.
AllVehicleData-Investigators can use this large, comprehensive and free directory to find vehicle purchase records that have been published online.
VinDecoderZ-Allows investigators to check the validity of a car and get detailed information on almost any VIN number, search car parts and check the car’s history.
MarineTraffic-Provides the investigator with a suite of tools designed to locate, monitor and reveal more about the vessels and ports that matter to their investigation.
Boat InfoWorld-Using this site investigators can get detailed vessel information on owner, hull identification number, hailing port, length, year built, boat builder and more.
Flight Tracker-This site provides an investigator with live flight data, airport delays, flight planning, flight routes, oceanic tracks and more. Investigators can search by flight, tail, airport or city.
FlightRadar24-This site provides a global tracking service that provides investigators with real-time information about thousands of aircraft around the world.
Cruise Ship Tracker-This resource allows investigators to quickly find any cruise ship to discover their position and itinerary schedule.
Container Tracker-This resource provides a direct search or a gateway to container companies so that investigators can quickly find any container to discover its position.
Air Cargo Tracker-This resource provides a direct search or a gateway to air cargo companies so that investigators can quickly find any container to discover its position.
AirNav RadarBox-Tracks flights, including private and military jets.
PlaneFinder-A global network of data feeds and antennas radars that receive data broadcast directly from aircraft for flight tracking.
Vessel Finder-Free AIS vessel tracking website that displays real time ship positions and marine traffic detected by global AIS network.
WikiRoutes-World’s public transport database edited by people on the principles of Wikipedia.
TomTom Traffic Index-Ranks urban congestion worldwide and provides free access to city-by-city information.
Maps, Satellites and Street View
GSMA 5G Coverage Map & Statistics-Tracks the 5G rollout around the world.
Instant Street View-Investigators can type in an address or place name to instantly see it in Google Street View.
StreetView-Investigators can use this tool to take in either a starting point and end point, or get a file of a route, or to get a playthrough of the Google streetview images that are available.
FollowYourWorld-Investigators can find out and be alerted when new imagery is available in both Google Maps and Google Earth.
LandsatLook-Investigators can interactively explore the USCG Landsat archive to view images, compare image features and changes through time and display configurable map information layers in combination with Landsat imagery.
GPS Visualizer-Investigators can find the latitude and the longitude of an address.
ZoomEarth-Updated daily, investigators can view NASA satellite images in a zoom-able interface.
OpenStreetCam-Investigators can get crowd-sourced street-level photographs in a location search.
GeoVisual Search-Using this tool, investigators can access public and commercial satellite imagery, detect visual similarities between scenes and recognize different types of objects across the globe.
DualMaps-Investigators can use this tool to combine synchronized Google Maps Aerial Imagery and Google Street view into one embedded control.
TerraPattern-Allows investigators to quickly scan large geographical regions for specific visual features.
TerraServer-Allows investigators to select imagery from different dates and of different resolutions. Investigators can measure surface distances and area on the images and get a number of image overlays such as road names, parks, schools, and other data.
LandViewer-Investigators can view recovered imagery from archive data in any zoom, and easily search and analyze huge amounts of the most recent earth observation data.
Military Grid System-Investigators can use this tool to locate points on Earth and display the MGRS coordinates for any point on Google Maps.
BatchGeo-Investigators can use this tool to quickly geo-code any address, visually group property information using Google maps, and produce customized maps.
MyGeoPosition-Investigators can use this tool to geocode a geoposition (latitude, longitude, elevation), create geotags, geo-metatags and kml files.
Bing Maps-This Microsoft tool is a satellite and mapping service that provides more recent and higher resolution imagery than Google.
Converting Coordinates-With this tool investigators can convert geographic coordinates between different notation styles.
Digital Globe-An easy to use satellite imagery tool.
EarthExplorer-Investigators can query and order satellite images, aerial photographs, and cartographic products through the U.S. Geological Survey.
Geograph-Provides geo-referenced images.
GeoNames-A database of location names offering a variety of different spellings in various languages.
HERE WeGo-Provides more recent satellite imagery than Google (in e.g. Iraq).
Sentinel Playground-Updated every 5-10 days with new imagery, dependent on cloud cover. Gives investigators the ability to explore a variety of GIS variables.
Wikimapia-Crowdsourced information related to geographic locations. Provides investigators with the ability to switch between Google/Bing/OSM. Massive amount of UCG information.
Yandex Maps-A Russian web mapping service providing detailed maps of the whole world. It includes a search, information about traffic jams, routing and street panoramas.
Echosec-A location-first social media geofencing platforms that allows investigators to scan social media networks to discover hyperlocal intelligence.
Livemap-Provides an interactive live map of conflict news in a variety of countries such as Afghanistan, Iraq, Syria, U.S., Ukraine, Venezuela, etc.
WarWire-Leverages inexpensive, yet powerful, technologies to help people more efficiently cover, investigate and respond to global war and crises.
Whoxy-Investigators can use this domain search engine’s reverse Whois tool to see a list of domain names owned by a Subject.
PubDB-A tool for investigators to find traffic stats of websites and lookup relevant information on a domain.
LandsatLook-Investigators can interactively explore the USCG Landsat archive to view images, compare image features and changes through time and display configurable map information layers in combination with Landsat imagery.
DomainCrawler-Investigators can use this site to find out domain ownership information and history.
Timer4Web-Use this site to check the history of a website’s changes, reveal all the fishy issues regarding any website and find relevant connections.
Whoisology-A tool to help investigators discover deep connections between domain names and their owners.
DNSdumpster-Investigators can discover hosts related to a domain; useful in finding visible hosts from an attackers perspective.
DomainBigData-Investigators can use this tool to find registrant and other domains owned by the same person. Get network details such as domain history, domains on the same IP and ownership.
DomainTools-Investigators can use this tool to discover domain name ownership and tech contact information.
TCPIPUTILS-For digital and fraud investigations investigators can use this tool to find out everything about a domain name, IP address or provider. Relationship information between these criteria and historical data is also available.
DNSTrails-Using this large repository of historical DNS data, investigators can search complete data for current and historical mapping of internet assets.
URLscan-Investigators can use this tool to analyze websites and the resources they request in the background.
WhoIsHostingThis-This site enables investigators to get information about the web host, IP address, name servers and more.
Visual Site Mapper-Investigators can quickly view a map of any given website.
Blue Backlinks-A useful tool for investigators to get a picture of a website’s linking profile and who is linking to that website.
Backlink Checker-A tool to help investigators discover how many back-links a website has and the value of each link.
SEO Plagiarism-This tool scans the internet to discover duplications to any content an investigator submits. Often used in order to verify the integrity of written content.
BuiltWith-Using this tool, investigators can discover what was used to build a specific website.
Find Subdomains-A tool that allows investigators to discover subdomains of a target domain and to view the attack surface of a target organization.
Black Book County Court Records-This site provides access to county court records.
Black Book Corporation Records-This site provides access to corporation records by state.
Voter Registration Records-A free research tool to study more than 60 million voter records.
Free Public Records Directory-Investigators can use this directory to find public record resources such as property records, vital records, criminal and court records, licensing and permits, and more.
SearchSystems-An organized group of links to over 55,000 databases by type and location to help investigators find property, criminal, court, birth, death, marriage, divorce records, business records and more.
Political Money Line-Investigators can use this resource to follow the money in political contributions.
Melissa Data Death Check-Investigators can check to see if a Subject died in the last 24 months.
Melissa Data Email Check-Investigators can enter a Subject’s address and discover a list of names, addresses & phones associated with an email.
Melissa Data Property Check-Investigators can enter an address and find all persons at an address or enter a Subject’s name to discover addresses associated with that name.
Melissa Data Campaign Contributions Check-Investigators can locate contributors to federal elections by ZIP code, discover amount donated and employer, and get contact and other information about Committee, candidate, party and more.
Blockchain-Provides investigators with real-time blockchain and bitcoin transaction data.
Wallet Explorer-Investigators can discover bitcoin wallet exchanges, pools, services, gambling and old/historic wallets. Useful in tracing bitcoins.
Bitcoin WhoIs–Investigators can use this tool to track who’s who in the bitcoin world, check a bitcoin wallet balance, check a bitcoin address, bitcoin transations, view and monitor bitcoin ownership and check BTC addresses to find connected websites or profiles.
IBAN Info-Investigators can use this site to check International Bank Account Numbers.
Legacy-Investigators can use this site to discover friends and relatives of a recently deceased Subject.
Death Record Search-Use this site to search for a Subject’s death record and get date of birth information.
SSN Validator-Investigators can use this tool to validate a Subject’s social security number.
U.S. Social Security Death Index-Provides investigators with a name index to deaths recorded by the Social Security Administration beginning in 1962. Current as of February 28, 2014.
Service Member Record Request-Investigators can use this page to request a Certificate verifying Active Duty Status for an individual on a specified date.
Business Lookup-Investigators can discover details for Current and Previous Businesses matching a specified company name and find businesses associated with a Subject’s name.
Domain / Website Archives
Wayback Machine-A digital library offering investigators 20+ years of web history. Content includes web pages, books and texts, audio recordings, recorded live concerts, videos, images and software programs.
Cached Pages-Using this tool, investigators can get a snapshot or a version of a web page saved at a specific time and stored by a web server as a backup copy. This is especially useful if the original page is unreachable.
Archive Today-A tool that investigators can use to take a ‘snapshot’ of a webpage that will always remain available to the investigator even if the original page disappears. Investigators can use this tool to capture tweets and any other content that may be deleted at a later date in order to preserve what was published.
VisualPing-Investigators can get an email alert if a webpage they are monitoring changes.
Follow That Page-A change detection and notification service that will send an investigator an email when a monitored page has changed.
Dark Web / Darknet / TOR
TOR Download-TOR is free software and an open network that provides access to the Dark Web .Onion sites and protect and investigator’s privacy.
Top 50 Dark Web Sites-Investigators can see the highest ranked Dark Web .Onion domains including top newly discovered Dark Web domains and other Dark Web information.
OnionScan-A free open source tools for investigating the Dark Web. Investigators can use this resource to monitor and track Dark Web sites.
ZeroNet-ZeroNet is a decentralized web-like network of peer-to-peer users with built in TOR-functionality for privacy. There is a Reddit community which offers support for ZeroNet.
Chip Mixer-A service that lets you hide your identity when transacting the Blockchain; allows you to remain untraceable and safe on the Internet, Deep, and Dark Web.
Insecam-Using this directory of online security cameras investigators can watch live street, traffic, parking, airport, office, road, beach and earth online webcams.
Dronestagr.am-This site provides a resource to find photos and videos taken by drones to get a birds-eye view of various locations.
EarthCam-Using this resource, investigators can view high-res video streams of various locations from unparalleled vantage points.
Opentopia-This site provides investigators with access to available webcams from around the world. Some webcams are from security cams in companies or semi-public places. Others are from private individuals who simply forgot to secure their webcam.
Thingful-Using this resource, investigators can find and use open IoT data from around the world.
Emporis-Investigators can get building data and construction projects information, including building, design and construction images from this resource.
Skyscraper Page-This site provides a buildings database resource for investigators who want building information, illustrations and diagrams. The database contains nearly 100,000 skyscrapers and buildings from around the world.
Scopedown-Investigators can use this tool to download videos from Periscope thus saving the transmission.
Zamzar-An online file converter that allows investigators to convert filed without downloading a software tool and supports over 1,000 different conversion types.
Hunter-Investigators can use this tool to find a Subject’s corporate email address & verify the deliverability of an email address.
FindAnyEmail-Investigators can use this tool to find a Subject’s corporate email address.
Norbert-Investigators can use this tool to find a Subject’s corporate email address.
DomainBigData-Investigators can use this tool to search by any email address, domain, IP or registrant name to reveal its identity or owner.
MailTester-With this tool investigators can enter an email address to verify if it exists or if there are problems with it.
Verifalia-Using this tool, investigators can verify an email address in real-time to see whether it’s properly formatted, and whether its mailbox exists and can accept new emails.
Email Format-Email Format allows investigators to find the email address formats in use at thousands of companies.
Have I been pwned?-Investigators can check to see if a Subject’s account has been compromised in a data breach.
Hacked Emails-Investigators can anonymously check to see if an email address has ever been compromised in a security breach.
Ashley Madison Leaks-Investigators can use this tool to see if a Subject’s email address and profile was compromised in the Ashley Madison hack.
Hashbase-Host webpages and content on the peer-to-peer web even when you are offline.
GoogleDocs-Allows investigators to perform keyword queries to search through publicly viewable Google Docs.
Pastebin-Allows investigators to upload and share text online such as source code. There are thousands of pastebins online, often geared towards particular groups or focuses.
PasteAlert-PasteAlert is a simple system to search pastebin.com and set up alerts. Investigators can set up alerts and receive an email whenever their search queries are found in new pastebin entries.
CourtListener-Investigators can search this database of millions of PACER documents and dockets. PACER is an electronic public access service of U.S. federal court documents.
Cryptome-This controversial site collects information about freedom of expression, privacy, cryptography, dual-use technologies, national security, intelligence and government secrecy. Some of the documents may be classified.
FreeOCR-OCR allows investigators to extract text from an image and convert it into an editable text document. Text will still need to be proofread as errors may arise during the recognition and translation process.
Converti.co-An advanced tool that allows investigators to convert files to any format.
IP and Website Analysis
Passive DNS-Collects, stores and analyses data from thousands of passive DNS collection sensors.
Censys.io-Find and analyze every reachable server and device on the Internet.
GEO IP Tool-Check your own IP. Useful to find out if your VPN is working.
ViewDNS-Using this tools investigators can gather data about a given website or IP address.
IP2Location-Investigators can find the IP geolocation, ISP, net speed, domain and usage type on a website visitor.
IPFingerprints-This tool allows investigators to find the approximate geolocation of an IP address along with some other useful relevant information.
Wigle.Net-Investigators can use this tool to get information about different wireless hotspots around the world. In addition, cell tower data is uploaded and displayed.
IPV6 Locator-Investigators can use this tool to discover IP address and geolocation information.
Shodan-Investigators can use Shodan to discover which of a Subject’s devices are connected to the Internet and where they are located. This information can be used to understand a Subject’s digital footprint.
ThreatCrowd-Investigators can use this tool to find and research artifacts relating to cyber threats.
I Know-Investigators can discover what Subject downloaded through a Subject’s IP address.
Images, Videos and Metadata
Amnesty YouTube Dataviewer-Provides a reverse image (video still) search and exact uploading time.
ExifTool-A platform-independent Perl library plus a command-line application for reading, writing and editing meta information in a wide variety of files.
Foca-A tool used mainly to find metadata and hidden information in the documents it scans.
FotoForensics-An image forensics tool that is simple, web based. Public access, information not private.
Image Forensics-A web-based image forensics tool that can easily identify fake or doctored images.
InVid-A toolkit provided to help journalists verify content on social networks. It saves time and helps journalists and investigators be more efficient in their fact-checking and debunking tasks on social networks especially when verifying videos and images.
Jeffrey’s Image Metadata Viewer-Forensically provides a set of free tools for digital image forensics. It includes clone detection, error level analysis, meta data extraction and more. It helps investigators see details that would otherwise be hidden.
Reveal Image Verification Assistant-A forensic tool that provides eight filters to detect sill images alterations.
Downsub-A tool that allows investigators to download videos they find on the internet, including videos found on YouTube.
YouTube Comment Scraper-A tool that allows investigators to download (scrape) all comments from a given YouTube video. The results include the comment text, username, date and other information.
YouTube Geo Search-A tool that allows investigators to search YouTube videos using location.
Deturl-A tool that helps investigators download YouTube and other streaming sites.
Twillo-This tool allows investigators to discover details about a Subject or business behind a phone number.
CallerID Test-Using this tool, investigators can look up the caller ID for any number.
CallerID Service-Investigators can use this tool to identify the name of an inbound caller; delivering the caller ID name to a handset when receiving a call, if caller ID enabled.
TrueCaller-Investigators can use this tool to find out who was trying to contact a Subject if the investigator has access to a Subject’s phone records.
NumberGuru-Allows investigators to see where a phone number is located and who the owner is.
CellRevealer-Investigators can use this free reverse lookup site to find information about a number’s owner.
TextMagic-Using this tool investigators can extract personal data from phone numbers.
Munitions & Weapons
ITrace-Free open guide by Conflict Armament Research that provides lots of information on different kinds of munitions and weapons presented graphically on a map format.
Trace Online Removal Request
Lumen-Collects and analyzes legal complains and requests for removal of online materials. Allows the study of the prevalence of legal threats.
Unknown Hash ID-If you come across a hash but don’t know what it is this tool will identify the type.
Business & Government
LittleSis-A free database of who-knows-who at the heights of business and government.