Site Investigation Tools

When you start to investigate a particular Internet site, I suggest you begin with these resources.

Domain Dossier Investigate domains and IP addresses. Get registrant information, DNS records, and more—all in one report.

InterNIC Public Information Regarding Internet Domain Name Registration Services

Network Solutions’ Whois  Search multiple top level domains at once to see if the domain name is in use. I use it to find the domain name in other top level domains.

Convert Host/Domain Name to IP Address and vice versa  Find the IP of a host machine (convert host to IP) or domain name (convert domain name to ip address) or find the name of one of the hosts at an IP address (convert ip address).

Using Traceroute Learn how to use and interpret traceroute results.

Additions thanks to Kirby:  Provides lot of information, but most importantly, it identifies other users of same Google Analytics account and all the sites using that account.  Sometimes shows older servers, which is useful when website has upgraded to cloud service or CloudFlare.

Getting a Date

Date formats are easily misinterpreted. For example, if you write 06-07-07, an American might assume that it represents June 7, 2007 or 1907 and an European might assume that it is 6 July 1907 or 2007. Some might  recommend using an unambiguous date system, such as an ISO 8601 European date format, (YYYY-MM-DD) but unless the reader  is a government worker they might get the month and date mixed-up.

The best method is to use a 3-letter abbreviation for the month preceded by the day and followed by the full year to avoid any confusion thusly, 6 Jul 2007.

The Investigator’s Eight Rules of Everything

1. Know your client’s motives and intentions.

2. Recognize questions that cannot be answered and those that cannot be answered legally.

3. Do not do anything that you would not do on the steps in front of City Hall.

4. Do not do or say anything you wouldn’t want published in the newspapers or Internet.

5. Do not do anything illegal because it is too inconvenient and difficult to cover your tracks.

6. Do not personate a living person.

7. Do not personate a representative of any existing company (or business) or anything to do with government.

8. Do not cause anybody to be concerned for his or her own safety, or the well being of any person, business, company, or property.

How to be an Internet Eyewitness

Eyewitness testimony is the weakest evidence an investigator can collect. The vessel that contains this evidence is subject to illness, death, corruption, and a myriad of defects that compromise the evidence. Being a trained investigator does not make you immune to all these weaknesses.

How we access and share information and how we communicate has changed dramatically over the last 30 years. This evolving technology is changing how we conduct investigations. It is changing how we observe criminal activity. The number sources of evidence available in some investigations have become overwhelming.

The Investigator as an Internet Eyewitness

The key to believable evidence gathered from the Internet is that it is visual, understandable, and could be reproduced if someone else did it at the same time as when it was originally collected.

When I review an investigation, I apply these criteria to determine if it was done by an expert or a bodger.

Investigators are taking on the role of eyewitness by observing evidence that might not be visible to any other available investigator as it appears only momentarily in internet venues. To be a reliable eyewitness, the investigator needs to create a record of what he or she sees at any particular point in time. This must be done in the same manner as handwritten notes. However, these records must provide a visual representation of the evidence collected. With Investigative Internet Research, the computer’s camera and mic, along with software that records screen activity, become the investigator’s notebook.

Typically, screenshots combined with written eyewitness reports, are used to record what an investigator observes in social media and other internet sites. However, screenshots and written reports do not provide a full representation of the research process or the evidence uncovered.

Twenty pages of social media content along with text detailing each screenshot is time consuming to produce and mind-numbing for a Judge or jury to endure. The Judge and jury need an eyewitness to tell them what happened and to illustrate why they should believe this evidence.

As with any eyewitness testimony, two corroborating witnesses are much better than one. The second eyewitness improves the credibility of the evidence presented in the courtroom. The consistency of the eyewitness testimony needs to be established through documentation as would be done with traditional witness statements given at different times to police before trial.

Follow the Script

Wherever possible, rehearse the visual, logical, and reproducible nature of the witness testimony to produce a clean copy of the investigators’ witness testimony. Don’t be afraid to script the testimony. Don’t be afraid to admit scripting the recorded testimony. Explain, if asked, that the recorded collection process is just a representation of what you did without any irrelevant material or wasted time. Explain that the recorded collection process is what really happened as it happened.


The hallmark of a good report is that it looks organised and complete without being over crowded with text and other material. The recorded testimony of the investigators must also be organised and complete without any extraneous content. Sometimes, accomplishing this requires scripting and rehearsal.

The investigator’s recorded process of collection must present the page as he saw it and the viewer must see and hear the investigator as he goes through the collection process. Just because you did this before and scripted the presentation of your collection process does not make the recorded content any less valid.


Above all else, be logical. The collection process must proceed in a straight line from a clearly explained starting point to the next logical point. Continue in like fashion until you reach a logical conclusion.

Explain the logic and connections in the accompanying report. Your report will probably need elements from PowerPoint, screen shots, images, graphs, etc. to accomplish this. Use visual aids to make connections and illustrate logic!

Explain how you got there. Explain what you saw. Explain the importance of what you found. Explain material that meets the elements of the offence or supports the continuation of the offence in some way.


The viewer must see and hear the second investigator doing the same thing as the first investigator. The viewer must see the second investigator collect the same material as the first one. Doing this will require some scripting and rehearsal.

Raw Evidence

Some situations happen too fast to allow scripting and rehearsal. In that case, you will have to use the raw recording of the IIR that captured the evidence. Even if you are creating a scripted and rhearsed presentation of the collected evidence, you should have a recording of the original IIR collection effort.

Bluetooth & Surveillance

I previously wrote about Bluetooth and Surveillance Detection and how Bluetooth could be used to determine if you were being followed.

Prior to a recent surveillance assignment, I scanned for nearby devices and was able to identify each of the other investigators’ mobile phones. This was not a good start. I required all the team members to demonstrate that they had shut off both Bluetooth and WiFi or at least set the Bluetooth signal to be hidden except to authorized devices and shut-off the WiFi.

Learning New Skills

All good investigators strive to learn new skills. Most skilled investigators are true readers. Some investigators are autodidacts.

To be an expert in your field, you should read one book about it every week. You heard me right, one book a week. But what happens when you are having difficulty getting through the book because you are encountering material that is over your head?

My solution to this is 3×5 index cards in two colors. I write down what is going well on one colour and what I am struggling with on another. Do this for small portions of the book at a time and use other resources to get a grasp of the problem area. Don’t move on until you overcome all the areas over which you struggle. If it is something you can practice hands-on in the real world, then do so. An example would be to actually use the the software you are reading about and work through the aspect that presents some difficulty. As you overcome the things you struggled with, write them on the going well cards but note that they were originally difficult.

Libelous Questions

I recently conducted a series of interviews that were quite sensitive in nature. This used to be a common occurrence for me. Today, it is less so. The prevalence of small electronic recording devices has curtailed my willingness to conduct such interviews. My concern is that you never know where the recording will go, nor do you know how it will be used or edited. You have no knowledge of the motives, ethics, or interests of the people who may at some point possess the recording.

Libel happens when you publish or make public a statement that is untrue about someone. Any investigator may inquire about things that prove to be untrue during an interview. Ask yourself what might happen if a snippet of the interview is published and it contains questions about something that was later proven untrue. The concept of the libelous question is well established in law. Investigators may have a certain privilege to ask questions but, this won’t stop someone from suing you. The public disclosure of private facts that might be part of an interview also causes concern. What if the interview reveals information that is not of public concern, and the release of which would offends someone? Unlike libel, truth is not a defense for what may be seen as an invasion of privacy.

You can never be certain that a recording device is not present. As a private investigator, I cannot search people and confiscate their electronic devices. Private investigators do not have any control over the people they interview, nor do they usually have control over the physical surroundings in which the interview occurs. This alters the nature of the questions asked and how they are put to the interview subject.

An extreme example from the U.S.A is one where a defense lawyer sat down with a prospective client in San Juan, Puerto Rico and asked about the GPS bracelet required by as a condition of bail. The prospective client told the lawyer that, “They speak to me through that thing”.  He filed a motion at the Puerto Rico State Superior Court to have the device removed before he interviewed prospective client. During that motion, he learned that it could be used to eavesdrop on their conversation without the lawyer or prospective client knowing. ( A recording knowingly made by the interview subject is not the only thing investigators need to consider.

This does not mean that every question will result in a libel action or that every room is bugged. It does mean that being dragged into an expensive libel action or media circus is something to consider before you start asking questions – especially ones that are sensitive.

Are you a Suspicious Person?

The surveillance conscious subject is more common today than forty years ago when I started in the business. Lawyers coach claimants on how to deal with surveillance. Criminals teach each other on how to recognise surveillance. Unfortunately, PI’s do not receive much training on how to avoid detection of their surveillance efforts.

Clumsy choice or use of the initial vantage point may doom the entire surveillance effort. If the subject sees someone repeatedly over Time, in different Environments and over some Distance, and if the surveillant displays poor Demeanor, then he will know that he is under surveillance. This means that initial vantage point, and the PI’s presence there, must not be remarkable in any way.

Don’t chose the initial vantage point without first evaluating the location. Understand the appearance and behaviour of the people likely to be at the vantage point. Don’t be like the inept guy in the old detective movie — you know the one — the guy leaning against a lamp pole reading a newspaper in the middle of the night.

Observe the vantage point from a position that the subject cannot see — you have questions that need answering. What type of person is at or near the vantage point? How long can you remain at the vantage point without arousing suspicion? What appearance, behaviour or persona will allow you to remain in place without arousing suspicion? Can you follow the subject in your adopted persona or must another team member do that?

Note Taking – Yesterday & Today

Skilled note taking is a critical skill for the Investigator. A client reminded me of this when he described a meeting with a Crown Prosecutor. The case in question resulted from an investigation that was conducted two years ago. The Crown went over his report and notes with a fine tooth comb in preparation for the trial.

Note taking has a long history. I see it in the margins of books, in notebooks, and this blog is a form of note taking for me. I’m in the process of writing a book and that entails a different form of note taking.

I found an New York Times article about 250 academics and civilians gathered at Harvard for a more self-conscious exercise: a chance to take notes on note-taking.

The article mentions the “Anxiety over the potential mindlessness of note-taking took on particular urgency during the digital annotation session, at which panelists debated whether the Internet and social media had ushered in a golden age of notes or doomed us to watch all our fleeting thoughts — if not our brains themselves — sucked down a giant digital drain, beyond the reach of future historians.” This is of particular interest to the Investigator.

The Investigator still needs to create clear paper-based notes to avoid having his work “sucked down a giant digital drain, beyond the reach of clients, prosecutors, and defense council.

Spys & Surveillance

I came across a book written during the Great War that has some good tips for the surveillance operator. It introduces the essentials of spycraft of a bygone era, but it remains particularly relevant to the Investigator who conducts surveillance operations.

The attitude that espionage is a sport in which the players appreciate and honor each other is truly misplaced, but the author’s observations about how to look like you belong in a place and about the key elements of disguise are timeless. The author’s description of how he gained access to critical installations to make observations are as relevant today as the Balkans in the 1890’s.

My Adventures as a Spy, By Lt. Gen. Sir Robert Baden-Powell, is an excellent short read.



Surveillance Detection & Bluetooth

I don’t do much surveillance work anymore, but recently I was pressed into service to assist a friend who was injured on the job. I took a file from his caseload at random and this led to a couple of interesting days.

This subject was very ‘surveillance-aware’. He must have been coached or read a book or two. He did all the right things, but in a very obvious and clumsy manner. This was obviously his first rodeo.

On several occasions, I observed him look at his phone then at the surrounding people. I realised that he was doing this with a purpose; I just couldn’t put it into context. It was like his practice of looking at the people in the area when he left a building and then watching the people exiting the door he used to leave the building.  Then I realised my problem was that I am a mobile telephone Luddite and I needed to talk to the younger folks — you know the type, the ones always fiddling with their gadget phone thingy.

My conclusion was that the subject was using his mobile phone to scan the area for Bluetooth devices. To do this, he selected relatively confined areas, or choke-points, where he could see people in the area that he might have seen before. If he saw the same Bluetooth device at more than one of these choke-points, he knew he was being followed, and that he stood a good chance of identifying the person following him.

This was a clever use of Bluetooth technology, but it was wasted on me. I don’t carry a Bluetooth-enabled mobile.

Why You Can’t Dictate an Investigative Internet Research Report

  1. A picture, screenshot or video is worth a thousand words. The person transcribing the dictation won’t place pics & video clip properly.
  2. There would be no efficiency at all in dictating a URL and there would be plenty of mistakes.
  3. Some website names are hard to pronounce and would lead to misspelling (although you might spell them out there is still a risk)
  4. One must have all the collected material at hand to create footnotes and appendices.