From where the legal and ethical lines sit, through geolocating photos, verifying images and claims, tracing social media accounts and reading an organization's public footprint, to writing the report. In 30 lessons you learn to carry out a consented, mandated investigation and report facts separately from inferences. Every example and exercise uses only fictional people and companies, your own photos and accounts, and a local lab.
The 30 lessons are split into 6 chapters. Working through them in order is recommended, but you can also dip into just the parts you need. * Researching people can turn into stalking or a privacy violation when misused. Do the exercises only with your own photos and accounts, fictional data and the lab on the security track (Mapping an employee's public footprint), and never point them at a real person. The legal explanations are for learning and are not legal advice.
The skills for researching people can become tools for stalking and doxing depending on how they are used. This chapter sets the legal and ethical lines, how to confirm the mandate and purpose, and how to keep records, before anything else.
Photos carry location clues in both their metadata and what they show. This chapter narrows down where a photo was taken from EXIF, reverse image search, signs and road markings and the direction of shadows, then you try it on your own photo.
Using an image or post without checking that it is genuine, and when and where it is from, makes the whole investigation wrong. This chapter spots edits, AI generation and recycled photos, and grades how confident you are.
When one person has accounts on several services, scattered facts join up. This chapter links accounts through usernames, avatars, posting times, connections and archives, and judges how sure the link is.
An organization's public information is raw material for impersonation. This chapter reads an organization from job ads, registrations, press releases and email address formats, and ends with how defenders reduce that exposure.
An investigation is only useful when it follows a plan and reports facts separately from inferences. This chapter finishes the plan, the link chart and the report, then puts everything together in a lab on a fictional employee.
After the 30 lessons, head to the Web Application Assessment course. The course order is on the security track. Membership unlocks every course.