The Missing Person OSINT Playbook: 48-Hour Triage

The First 48 Hours

OSINT can preserve useful public evidence quickly. When an individual goes missing, law enforcement often faces delays due to jurisdictional bureaucracy or mandatory waiting periods, while open-source review can help secure time-sensitive context for the case.

The immediate goal is not necessarily to find the person, but to preserve their digital footprint before it is intentionally scrubbed or locked by privacy settings.

Immediate Triage: The Zero-Hour Protocol

Within the first 6 hours of a confirmed disappearance:

1. Archive The Core Net: Immediately cache all known Facebook, Instagram, X, and TikTok profiles using Wayback Machine and offline archival tools. If family members log in to "check" the accounts, or if a threat actor alters them, the primary evidence is preserved.
2. Scrape the Friends List: The suspect or the last known contact is almost always in the target's immediate digital network. Scrape all follower and following lists immediately.
3. Download High-Res Media: Obtain the highest possible resolution photos of the subject for immediate comparison inside our Facial Recognition guide.

Hour 6 to 24: Establishing the Timeline

• Venmo Velocity: Query public Venmo and CashApp feeds. A $15 charge for generic emojis at 2:00 AM provides a concrete timestamp and potential geolocation.
• Gaming Communities: Preserve accessible public alias references for the missing-person investigation workflow. Do not infer private communications from a shared handle or community membership.
• Pivoting via Usernames: Take the subject's primary username (e.g., SkaterBoy99) and review it across relevant platforms and communities. You may discover a secondary account where they discussed their plans or recent movements.

Hour 24 to 48: Geospatial Intelligence (GEOINT)

• Public Map Context: Preserve relevant public posts and timestamps for the missing-person investigation workflow. A map pin or crowd heatmap is contextual evidence, not proof that the missing person was there.
• Strava/Garmin Leaks: Check fitness trackers. Even if the subject didn't take their phone, if they took their smartwatch, the device may auto-sync to a known Wi-Fi network along their route.

OSINT does not replace law enforcement; it provides law enforcement with a hyper-accelerated briefing package to execute targeted, physical warrants.