Archive for the 'Methods' Category

Page 2 of 8

How to Find Out Where a Picture was Taken

Published on October 3, 2011 in Methods, Private Investigator and Search Strategies. 1 Comment Tags: , , , .

Most of the time, there isn’t much information available within the picture itself. However, certain smartphones (iphone) and high-end cameras have GPS built in, and geo-tag pictures. Advanced cameras also store metadata such as the model name, exposure settings, etc. Even without the location information, the Exchangeable Image File format (EXIF) info stored on the image is still useful in the evidence gathering process.

In Firefox, right click on the image and select Copy Image Location.

Go to http://regex.info/exif.cgi and paste the image location into the Image URL box. Now click on the View Image at URL button.

The next page displays EXIF info, or information on the Camera, and, if available, the GPS-based location where the picture was taken. Scroll down for the GPS info or click on the map service link in the box on the left side of the page.

Toronto Prostitution Sites

Published on September 30, 2011 in Canada, Craigslist, Methods, Private Investigator and Sources. 0 Comments Tags: , , , .

As an Investigator, I often have to search for references to a certain telephone number.  A few years ago, these searches started to involve looking for a possible prostitution involvement.  This is a search for which I frequently get requests.

Doing this isn’t rocket science, so here is my current list of sites.  Of course, I have devised a way of automating the search process and I’m not going to tell you how I do that.  Just remember, you must document your search method and the results properly if this is could end-up as evidence.

Censorship: You be the Judge

Google Ad-sense sent an automated notice that their machines were going to stop serving ads because I listed the sites that we often search for telephone numbers as explained above.  Of course machines can’t read, but they can find links. Now Google is censoring content because they don’t like to place ads on anything that has links to sites that they don’t like, in this case so-called ‘adult content’.  I can understand not wanting to be involved in promoting pornography or the sex trade, but this is only a machine telling me what to write and there is nobody to talk to and no living person at Google ever read this article.

iSeek Search Engine

Published on September 26, 2011 in Methods, Search Engines, Search Strategies and Sources. 0 Comments Tags: , , .

iSeek is a good search engine to use when you are searching by a person’s name. It clusters search results by topic, people, places, and organisations.

ChangeIP Proxy

Published on August 1, 2011 in Communication, Methods, Privacy, Private Investigator and Security. 0 Comments Tags: .

ChangeIP, states that its Private Proxy is an encrypted change IP proxy that not only changes your IP address, but also encrypts your Internet browsing sessions to keep you safe and protected.

Perhaps this is better than Zerobank, but perhaps not, I have not tried it yet.  It may offer some utility over TOR in that it may allow viewing YouTube and similar video content, but I doubt it will offer the anonymity of TOR.

The New Neighbourhood

Published on June 2, 2011 in Company Research, Due Diligence, Ethics, How to Become a Professional Private Investigator, Methods, Private Investigator, Search Engines, Search Strategies, Social Sites, Sources and Training & Education. 0 Comments

In the past, most investigations included ‘neighbourhood inquires’ where neighbours were questioned regarding the subject’s activities and lifestyle.

We still do neighbourhood inquiries, but over the last three decades this has produced less and less information of value, to the point that we now consider this an extraordinarily expensive investigative process.

Neighbours rarely share derogatory information or observations about the subject, and fewer still, even know the subject as most urban neighbourhoods are too transient and social contact is minimal.

Today’s neighbourhood isn’t tied to geography, but rather by Internet connectivity. The advent of virtual media has created virtual neighbourhoods that the Investigator must be adept at navigating and interrogating.

This new neighbourhood may reveal inappropriate pictures, drug and alcohol abuse, bad-mouthing of employers, co-workers, clients, and organisations. It may reveal poor communication skills and much worse – much of which is found exclusively online.

Unfortunately, inexpert interrogation and navigation of this neighbourhood has caused issues.

The ubiquity of Internet search engines and a lack of training and guidelines may put the Investigator in contravention of some laws if the resulting information creates a record of personally identifying information that is subsequently mishandled. Possession of Internet search results may impose either declared or implied responsibilities regarding the handling of the data in some jurisdictions.

A casual and undisciplined approach to Internet and social media searching raises questions regarding the competence, handling, fairness, storage, and analysis of the data. The role of the Investigator doing the searching should be clear from the outset. The sources and methods employed should also be clear throughout the search process and its reporting.

Virtual Identities

The subjects of an investigation do not line-up to tell the Investigator all his or her screen names and their related email addresses.

The Investigator must find the screen names and related email addresses from what he already knows at the beginning of the Investigation to build an online profile of the subject.

The Investigator must also recognise that screen names are often used by more than one person or a screen name may be used maliciously.

As the old New Yorker cartoon said, “On the Internet, nobody knows you are a dog”.

Navigation & Interrogation

The unstructured nature of data available on the Internet, and its density, creates problems for the searcher.

Google may say it found three million hits, but it will only show one thousand. The results will change depending on which version of Google searched and whence it is searched.

When searching for information about a person or company, the Investigator shouldn’t get bogged-down by search engine hits, but rather go straight to databases that have the right category of data for his purposes. This may mean searching sources not indexed by the search engines.

Google isn’t a substitute for knowledge and experience.

Norwich Orders

Published on May 11, 2011 in Courts, Fraud, Legislation, Methods and Private Investigator. 0 Comments Tags: .

Norwich Pharmacal Order

A Norwich order is a pre-action discovery mechanism.

In Norwich Pharmacal Co. v Customs and Excise Commissioners [1974] AC 133, the owner of a patent knew that infringing goods were entering the UK, but could not ascertain the identity of the goods. The Commissioners, in the course of performing their duties, had information that would identify the imports.  Also, they had unknowingly played a part in facilitating importation of infringing goods. The House of Lords found that where a third party had become involved in unlawful conduct, they were under a duty to assist the person suffering damage by giving them full information and disclosing the identity of wrongdoers. If the third party bears expense in assisting compliance with an order, the person seeking assistance is bound to reimburse those expenses. That expense however would be reflected in an award of damages against the ultimate tort-feasors, and this be recovered after the final hearing.

Canada and the Norwich Order

The Court in Isofoton S.A. v. Toronto Dominion Bank, outlined five elements that a court should consider before granting a Norwich order.

Continue reading ‘Norwich Orders’

Self-destructing IMs and Emails

Published on May 4, 2011 in Communication, Methods and Private Investigator. 0 Comments Tags: , .

Big String offers self-destructing IMs and emails so that you won’t leave any evidence of their online communications. It works with many popular IM clients.

Ten Minute Email Address

Published on May 2, 2011 in Communication, Methods and Private Investigator. 1 Comment Tags: .

10 Minute Mail gives you an email address that is good for 10 minutes, then expires. This allows you to register with sites that require an email validation. Using this helps you to cover your tracks when using such sites.

Analysis, Synthesis, & Prediction

Published on April 25, 2011 in Methods. 0 Comments

Principles of Accurate Analysis and Synthesis

This article is about making predictions. Predictions are just best guesses of what is going to happen in the future based on known intelligence (information). This article can be useful for any type of prediction including military prediction, business prediction, and science prediction

Analysis is the process of breaking down known pieces of information (intelligence) into smaller pieces of information (intelligence) so that the details can be studied.

Synthesis is the process of putting the studied small pieces of information (intelligence) back together in a way that will paint a picture of possible future events.

Data analysis and synthesis should be based on facts or data that has a high order of probability of being accurate.

Read the full article

Getting a Phone Number from an Email Address

Published on April 22, 2011 in Craigslist, Methods, Search Engines, Search Strategies and Sources. 0 Comments Tags: .

You have an email address, and need the subject’s phone number.  No repository exists that correlates an email address with a phone number.  This requires some investigative work.  First, use the free reverse email look-ups to help in your search.  To find these, use the search term email reverse lookup in your favorite search engine.  Normally, these are of little use, especially with anyone who lives outside the U.S.A..

The following represents my usual process before resorting to confidential resources.

  • Check the email address in Google. Use it as a reverse email search. You may find an associated cell phone number that is still in service.
  • Do reverse email search using Pipl.com this finds content that other web crawlers miss. Go to Pipl, click the “Email” link, enter the email address. The results may display online sites and documents where that email address appears and you may find an associated telephone number at one of those sites.
  • Kgbpeople.com and SocialMention Search in social networks using Kgbpeople. Enter the email address in the “Name:” field at the top of the page, select the country in the pull-down menu and press the “Search” button. Select one of the four tabs at the top of the screen — Social networks, Search engines, Photo and video, or Personal — then review the results for a cell phone number associated with that email address.  Do a similar search using SocialMention.
  • AllofCraigs and Search All Craig’s Search Craigslist ads. It’s a handy place to conduct a reverse email search. Enter the email address in the field and press the Hopefully, you will find some ads that reveal a phone number connected to that email address.

Disabling Geolocation

Published on April 11, 2011 in Methods, Power User Tips, Privacy, Private Investigator and Search Leakage. 0 Comments Tags: , , , .

In a recent article about the DuckDuckGo search engine, I wrote about search leakage.  Many programs leak your location. Internet Explorer does not have a geolocation feature yet, but Firefox and its associated email program do.  Here is how to disable this annoying feature that may reveal that you are investigating a person or  company by your visits to their websites.  It doesn’t take a genius to figure-out that if he defrauded somebody in Toronto that web site visits from someone in Toronto might mean he is being investigated.

To test your browser, first go to this site, then make the changes below and revisit it to see the difference.

Firefox

• Type ‘about:config’ in the address bar without the ‘ ’
• Discard the warning by hitting ‘yes’
•Scroll down until you reach ‘geo.enabled’ or you can simply search for ‘geo.enabled‘
• Doubleclick the item and it will change from its default value ‘True’ to ‘False’
• Scroll down until you reach ‘geo.wifi.uri’or you can simply search for ‘geo.wifi.uri‘
• Rightclick the Value of ‘geo.wifi.uri’ and click ‘Modify’
• Type in ‘localhost’ and hit ‘OK’

Thunderbird

• Goto ‘Tools’
• Goto ‘Options’
• Goto ‘Advanced’
• Hit ‘Config Editor’ on the General tab
• Discard the warning by hitting ‘yes’
• Scroll down until you reach ‘geo.enabled’ or you can simply search for ‘geo.enabled‘
• Doubleclick the item and it will change from its default value ‘true’ to ‘false’

Search Engine Results

Doing a test search in Bing and Google revealed that turning off the geolocation feature changes the results rather dramatically.  All the search results in my test search went from Canada-centric before turning off the geolocation to U.S.-centric after it was turned off.

The Olde Ways

Published on March 7, 2011 in Espionage, Industrial Espionage, Methods, Private Investigator, Security and Surveillance. 0 Comments Tags: , , , , .

I was summoned to a meeting with a client. The client firm is over a century old. This successful firm has learned a thing or two about security.

I was asked to surrender my electronic gadgets. Being of the old school, I had none. This pleased the gatekeeper. I was led to a room furnished with only a curious table and four old wooden bankers chairs. No telephone, no electrical outlets, one florescent light fixture above the table.  The gatekeeper had to unlock the room. She then waited at the open door until my contact arrived.

My contact enters and places pieces of chalk and a chalkboard eraser on the the table. Most of the table top is painted with chalkboard paint.

We eventually compose a handwritten Memorandum of Agreement regarding the engagement, sign it, and off we go.

These people understand the rules, especially Rule #1 — If you don’t want it overheard, don’t say it. But I must admit, I have never seen a “Magic Slate” table before.

Erase Data with a Hammer

Published on February 28, 2011 in Forensic Science, Forensics, Methods, Private Investigator, Security and The Investigator's Computer. 1 Comment Tags: , , , , , , .

Flash-based solid-state drives nearly impossible to erase

Researchers from the University of California at San Diego delivered a paper at the FAST-11 Conference in San Jose, Calif., last week that shows it’s almost impossible to reliably erase data from a solid state drive.

The report, Reliably Erasing Data from Flash-Based Solid State Drives (PDF), goes through all of the known techniques for erasing data and they found the best method was a big hammer.

27 Mohammeds

Published on February 23, 2011 in Methods, Private Investigator and Search Strategies. 0 Comments Tags: , , , , .

Identity

In conducting Internet research we encounter the problem of persona isolation. In national security circles this is called the “27 Mohammeds problem”.  Essentially, how do we know that the John Smith mentioned in a blog is the specific John Smith we are researching?

Reputation Evaluation

This leads to a another difficulty.  An Internet reputation may not reflect reality.  The Internet reputation may be fabricated out of malice.  We must evaluate a conviction in the august Internet Court and determine if we believe it enough to not take a risk on the subject firm or person.

Related Articles

The following related articles may help you deal with this problem:

Escorts, Incalls, Outcalls, and Massage Parlours

Published on January 17, 2011 in Canada, Methods and Sources. 0 Comments Tags: , , , , , .

The demise of the “Erotic Services” section of Craigslist in Canada has led to a rush to fill the vacuum. This has made it harder to identify prostitution ads being run by people who are carrying out other scams such as exaggerated or fraudulent insurance claims.

As these ads move to other venues, a predominate source will rise to the top. At this time I predict that it will be Duttslist or the Toronto Backpage site.

The following is a list of 25 sites vying for the position of top prostitution ad site in Canada:

Some of these sites are easy to search by telephone number and some are not.

Censorship: You be the Judge

Google Ad-sense sent an automated notice that their machines were going to stop serving ads because I listed the sites that we often search for telephone numbers as explained above.  Of course machines can’t read, but they can find links. Now Google is censoring content because they don’t like to place ads on anything that has links to sites that they don’t like, in this case so-called ‘adult content’.  I can understand not wanting to be involved in promoting pornography or the sex trade, but this is only a machine telling me what to write and there is nobody to talk to and no living person at Google ever read this article.