Bellingcat’s Digital Forensics Tools

A List of Open Source Verification and Investigation Tools and Methods

Hello, welcome to Bellingcat’s openly and freely available digital list of tools and methods we use during our open
source investigations. You can follow our work on our ​website​, ​Twitter and ​Facebook​. ​Feel free to suggest tools not
yet listed here! ​This is version 3.0 (February 12, 2018).

The list includes satellite and mapping services, tools for verifying photos and videos, websites to archive hyperlinks,
and much more. The list is long, and may seem daunting. There are guides at the end of the document, highlighting
the methods and use of these tools in further detail. We also provide tailored digital forensics workshops.

Currently, I’m trying to find a better way to thematically structure this list and I’m working on a more extensive guide
with simple case-studies to the tools we use most. This will be an openly available and digital guide in English and
hopefully Arabic too. I will share a link here once it is published. Feel free to contact me with questions or suggestions
via e-mail (​christiaantriebert@bellingcat.com​) or Twitter (​@trbrtc​).

Maps, Satellites & Streetview

Name Description Pros Cons Link

Bing Maps Microsoft satellite and More recent and Difficult to check the bing.com/maps
mapping service. higher resolution date of the imagery
imagery than Google, (​this tool​doesn’t work
e.g. in Iraq. anymore)

converting Convert geographic synnatschke.de/geo-to

coordinates coordinates between ols/coordinate-convert
different notation er.php
styles.

DigitalGlobe Satellite imagery Preview available via $ discover.digitalglobe.c

vendor. the catalogus, search om
tool very easy to use.

DualMaps Combines Google’s data.mashedworld.co

road maps, aerial view, m/dualmaps/map.htm
and street view in one
embeddable tool.

EarthExplorer earthexplorer.usgs.gov

Geograph Georeferenced geograph.org

images.

GeoNames Database of location Wide variety of geonames.org

names. different spellings in
various languages.

Google Earth Pro Add a ​Bing Maps [​software​] Training

satellite imagery layer​. guides ​here​.
Historical imagery.

Google Maps StreetView, many No historical satellite maps.google.com

 
 

large cities in U.S., imagery, but historic

Europe, modelled in streetview images
3D. available in many
places.

Google Photos
(former Panoramio)

HERE WeGo More recent satellite wego.here.com

imagery than Google
in e.g. Iraq.

Mapillary Crowdsourced street mapillary.com

level photos.

OpenStreetCam openstreetcam.org

OpenStreetMap openstreetmap.org

Radiant Earth radiant.earth

Sentinel Playground Updated every 5-10 Generally low apps.sentinel-hub.com

days with new resolution of 10m/px. /sentinel-playground
imagery, dependent on
cloud cover.
Ability to explore a
variety of GIS
variables eg NDVI or
NDWO.

TerraServer Satellite imagery Highest resolution $ to preview terraserver.com

vendor. available (0.3m). high-resolution satellite
imagery.

Wikimapia Crowdsourced Possibility to switch wikimapia.org

information related to between
geographic locations. Google/Bing/OSM.
Massive amount of
UCG information.

Yandex Maps yandex.com/maps

Geobased Searches
Name Description Pros Cons Link

Echosec Geobased searches. Instagram, Twitter, $ echosec.net

VKontakte, Foursquare

Liveuamap Interactive live map of Variety of countries liveuamap.com

conflict news. available: ​Afghanistan​,
Iraq, ​Syria​
, U.S.,
Ukraine​, Venezuela,
etc.

Photo-Map.RU Geotagged VKontakte photo-map.ru

posts.

Twitter Insert in search box: There’s a ​tool​for it too. Easy to fake.

 
2
 

geocode:[coordinates],
[radius-km], for
example:
geocode:36.222285,43
.998233,2km (only
works with km, so
500m = 0.5km)

WarWire Geobased searches. $ warwire.net

YouTube youtube.github.io/geo-
search-tool/search.htm
l

Images, Videos and Metadata

Name Description Pros Cons Link Guides

Amnesty Reverse image Searches for a amnestyusa.org/sit Advanced  

YouTube (video still) search number of still, not es/default/custom- Guide on Verifying
Dataviewer and exact each frame is scripts/citizenevide Video Content
uploading time. included (thus nce
results may be left
out).

Exiftool Read and Floss, Cross Yet to encounter https://www.sno.p See forum and
manipulate platform and very any (Have only hy.queensu.ca/~p FAQ on linked
metadata for a easy to integrate used on hil/exiftool/ page
vast number of file in scripts. GNU/Linux).
types. Note: no
GUI

Foca Extract metadata. Windows based, No native linux elevenpaths.com/l NullByte

open sourced support. abstools/foca/inde
2017. x.html

FotoForensics Image forensics Simple, web Public access, fotoforensics.com

tool. based. information not
private.

GooFile Extract metadata. Simple to use. Doesn't work well tools.kali.org/infor Ascii cinema
outside Kali mation-gathering/g
oofile

Image Forensics Web based image Can easily identify Public access, 29a.ch/photo-foren
forensics tool. fake or doctored information not sics/#level-sweep
images private.

InVID Verification plugin invid-project.eu https://www.youtu

to help journalists (plugins for be.com/watch?v=n
verify images and Chrome​, Firefox mgbFODPiBY
videos. Contextual (​Windows​, ​Mac
data, Metadata, OS X​, ​Linux​)
reverse search
(Google, Yandex,
Baidu), image
forensic,
Magnifie)r

Irfanview Extract metadata. irfanview.com

 
3
 

Jeffrey's Image Extract metadata, Only requires web Public access, exif.regex.info/exif.
Metadata Viewer online. browser. information not cgi
private.

Reveal Image Forensic providing Web-based image http://reveal-mklab Documented with

Verification eight filters to tool. .iti.gr/reveal/index. examples and
Assistant detect still images Also available html explanations of the
alterations. within InVID different filters.
verification plugin. Developed in
Reveal​project.

reverse image Recommended

search plugin: RevEye,
which searches
Google, Yandex,
Baidu and Bing.

SpiderPig Extract metadata. Command line Requires github.com/hatlord

interface and dependencies and /Spiderpig
scriptable. knowledge of web
technologies.

Splunk Extract metadata. Report grade Not simple to blog.sweepatic.co Sweepatic.com

analysis and setup and deploy. m/metadata-hacke
presentation. rs-best-friend

Social Media
Facebook

Name Description Pros Cons Link Guides

Graph.tips Automatically graph.tips/beta

advanced
searches for
Facebook profiles.

IntelTechniques Various tools for inteltechniques.co

analyzing m/menu.html
Facebook profiles
and pages.

Facebook Live broadcasts facebook.com/live

livemap around the world. map

peoplefindThor peoplefindhtor.dk

Search Tool Find accounts by netbootcamp.org/f

name, email, acebook.html
screen name, and
phone.

StalkScan Automatic stalkscan.com

advanced
searches per
Facebook profile.

Video Download fbdown.net

Downloader Facebook videos.

 
4
 

Online

Skopenow Social Media Skopenow.com

Investigations -
name, phone,
email, username
searches.

Instagram

Name Description Pros Cons Link Guides

Websta Find other websta.me Use direct URL

locations in with a location ID,
Instagram’s e.g.
database near a websta.me/locatio
particular location. n/116231

LinkedIn

Name Description Pros Cons Link Guides

Socilab Visualise and sociliab.com

analyse your own
LinkedIn network.

Snapchat

Name Description Pros Cons Link Guides

Snap Map Searchable map of https://map.snapc

geotagged snaps. hat.com

Tumblr

Name Description Pros Cons Link Guides

Tumblr Originals Find original posts studiomoh.com/fu

per Tumblr, thus n/tumblr_originals
excluding reblogs.

Twitter

Name Description Pros Cons Link Guides

InVID verification InVID plugin Allows to InVID verification Automates the

plugin provides a Twitter document use plugin conversion
advanced search cases from the between calendar
by time interval up past without APIs date and Unix
to the minute. and time limit. timestamp in
Allows to search Twitter advanced
for content within a search:
user-defined time https://youtu.be/n
range after a mgbFODPiBY?t=4
breaking news. m21s

Onemilliontweet Tweets map per onemilliontweetma

map locations up to 6 p.com
hours old, keyword

 
5
 

search option.

Treeverse Chrome extension t.co/hGvska63Li

to visualise Twitter
conversations.

Tweetreach Find reach of Advanced search tweetreach.com

tweets. operators
available, same as
Google advanced
search.

Twitter advanced Search by date, twitter.com/search

search keywords, etc. -advanced

Twitter geobased geocode:[coordina There’s a ​tool​for it

search tes],[radius-km], too.
for example:
geocode:36.22228
5,43.998233,2km

Twlets Download Easy and quick to Goes up to 3,200 twlets.com

anyone’s tweets, use, there’s a tweets, followers
followers and likes Chrome extension and likes.
in an Excel sheet. too.

quarter tweets Geobased Twitter qtrtweets.com/twitt

search. er

YouTube

Name Description Pros Cons Link Guides

Amnesty Reverse image Searches for a amnestyusa.org/sit Advanced  

YouTube (video still) search number of still, not es/default/custom- Guide on Verifying
Dataviewer and exact each frame is scripts/citizenevide Video Content
uploading time. included (thus nce
results may be left
out).

Geo Search Tool Search for youtube.github.io/

YouTube videos geo-search-tool/se
based on location. arch.html

Transport
Air
Name Description Pros Cons Link Guides

AirNav RadarBox Tracking flights, radarbox24.com

including private
and military jets.

ADS-B Exchange Tracking flights. Includes a number global.adsbexchan

Global Radar of ​military aircraft​. ge.com/VirtualRad
ar/desktop.html

 
6
 

FlightAware flightaware.com

FlightRadar24 Tracking (civilian) $ to go back in 12 flightradar24.com

flights. month archive.

PlaneFinder planefinder.net

Marine
MarineTraffic marinetraffic.com

VesselFinder vesselfinder.com

Railway
Trains Full interactive Denmark​, ​France​
,
maps of various Germany​,
railway networks Netherlands
in European
countries.

Misc
WikiRoutes Public transport wikiroutes.info
database.

Date & Time

Name Description Pros Cons Link Guides

SunCalc Make suncalc.net​/

approximation of suncalc.org
time of the day
using shadow
direction.

Wolfram|Alpha Does a load of wolframalpha.com

things, including
weather
forecasts ​per day
and location.

Individuals, WhoIs, IPs, Website Analysis

Name Description Pros Cons Link Guides

Passive DNS Collects, stores Complete 15 API calls day,

and analyses data unadulterated 15 web based community.riskiq.c
from thousands of historical and searches a day. om
passive DNS current DNS
collection sensors. information.

Censys.io Censys continually Complete wealth None Censys.io

monitors every of knowledge of
reachable server internet connected

 
7
 

and device on the devices.

Internet.

Domain Tools domaintools.com

DNS History Collection of Free, simple and Sometimes limited DNS History
historical DNS easy to use. in availability.
information.

Geo IP Tool Check your own geoiptool.com

IP, handy to check
if your VPN is
working,

Shodan Internet of things Can find heaps of Lives in the shodan.i​o

search engine. misconfigured grayzone...
network connected
devices.

● IXMaps​, ​IXMaps
● Network-Tools
● Open Site Explorer
● People search
○ Peekyou​, ​peekyou.com
○ Pipl​, the world largest people search engine, find persons behind an e-mail
address, social media username, or phone number, ​pipl.com
○ Yasni​, ​yasni.com
○ Zaba Search​, only US, ​zabasearch.com
○ publicrecords.searchsystems.net
○ cemetery.canadagenweb.org/search.html
○ opencorporates.com
● Robtex
● Search IRC
● Shodan Computer Search
● Utrace
● ViewDNS
● D​N​
S​​H​i​s​t​o​r​i​c​a​l​​D​a​t​a,​ ​research.dnstrails.com
● SpyOnWeb​, to retrieve websites by their Tracking codes,​​spyonweb.com
● Whois​, for domain search and information, ​whois.net​or ​whois.icann.org

Archiving, Downloading & Internet Storage

Name Description Pros Cons Link Guides

Archive.is Let’s you archive

any webpage.

DMCA Search takedown lumendatabase.or

notices g

 
8
 

Gruber Slideshare http://grub.cballen

downloader ar.me/

Historic Breach https://publicdbhos

Database List t.dmca.gripe/rando
m/

Wayback Archives websites. github.com/hartato

Machine Download an r/wayback-machin
entire website e-downloader
from the Wayback
Machine.

Miscellaneous
Name Description Pros Cons Link Guides

BlockExplorer Following a bitcoin https://blockexplor

trail or following a er.com
bitcoin account ?

Check Collaborative checkmedia.org User guide​,

fact-checking. Bellingcat’s ​
Check
team

Document Useful for github.com/firstloo

Redaction removing kmedia/pdf-redact-
potentially harmful tools
content in Pdfs
before viewing,
like traceback.

Google Search Such as searching googleguide.com/

Operators for a specific advanced_operato
filetype (e.g. PDF) rs_reference.html
or on a specific
website.

Hunch.ly Research sidekick. hunch.ly

Insecam Network live IP ​insecam.org/en/

video cameras
directory.

LittleSis Database of littlesis.org

who-knows-who at
the heights of
business and
government.

Lumen Collects and lumendatabase.or

analyses legal g
complaints and
requests for
removal of online
materials, helping
Internet users to
know their rights
and understand
the law. These

 
9
 

data enables us to
study the
prevalence of legal
threats and let
Internet users see
the source of
content removals.

Maltego paterva.com/web7

Montage For collaborative montage.storyful.c

working. om

OpenCorporates Database of
companies in the
world.

People tracer Site will be closed peopletracer.co.uk

in March 2018.

TimelineJS by Make an
Knight Lab interactive timeline timeline.knightlab.
of events. com

Unknown Hash On investigation if onlinehashcrack.c

ID you come across a om/hash-identificat
hash but don’t ion.php
know what it is
(and warrants
further
investigation) this
will identify the
type.

Visual vis.occrp.org
Investigative
Scenarios (VIS)

Zoopla Search for zoopla.co.uk

property with the
UK's leading
resource. Browse
houses and flats
for sale and to
rent, and find
estate agents in
any area.

Guides & Handbooks

● American Press Institute Fact-Checking Resources​,

americanpressinstitute.org/training-tools/fact-checking-resource
● Bellingcat’s resources​, w ​ ww.bellingcat.com/category/resources/how-tos​, for example:
● E​x​p​o​s​i​n​g​​t​h​e​​I​n​v​i​si​​bl​​e,​ a project by the Tactical Tech Collective,
exposingtheinvisible.org

 
10
 

○ Includes multiple guides (website data scraping, Google Dorking etc.), resource
links, and examples of successful investigations in various fields
● First Draft News​’​​resources, some of which have been written by Bellingcat members,
firstdraftnews.com/resources​, for example:
○ How to Get Started in Online Investigations
● Flash Environmental Assessment Tool, ​for identifying harmful substances and their
effect on the environment after industry has been destroyed:
https://docs.unocha.org/sites/dms/Documents/FEAT_Version_1.1.pdf
● Poynter​, fact-checking how-to guides, ​factcheckingday.com/#how-to
● Poynter​, fact-checker’s code of principles, ​poynter.org/fact-checkers-code-of-principles
● Verification Handbook​(PDF) is a great place to go to find tools to verify digital
information, ​verificationhandbook.com
● Washington Post​, fact-checker’s guide, ​washingtonpost.com/news/fact-checker
● Washington Post​, fact-checker tool, ​washingtonpost.com/news/fact-checker
● WITNESS
○ Activists' Guide to Archiving Video
○ Video As Evidence: Verifying Eyewitness Video

WEAPONS

● Open guide called “​Itrace​” by Conflict Armament Research, lots of information on

different kinds of munitions and weapons presented graphically on a map format,
itrace.conflictarm.com

Data Visualisation
Name Description Pros Cons Link Guides

DataBasic.io Web tools for databasic.io/en

beginners that
introduce concepts
of working with
data

DataWrapper Easy to use chart datawrapper.de

and mapping tool

Google Fusion fusiontables.googl

Tables e.com

Maptia maptia.com

Visual vis.occrp.org
investigative
scenarios

RAWGraphs Free webtool to app.rawgraphs.io

quickly visualize
your data

Open Desktop Searches opensemanticsear

Semantic Search unstructured data ch.org/doc/deskto
well p_search

 
11
 

TrustServista Online story www.trustservista.

verification and com
visualisation tool

Neo4j Graph Platform neo4j.com

Online Security & Privacy

● Check for every digital service you use whether you have enabled ​two factor
authentication (2FA)​, ​twofactorauth.org
● Security in a box guide: ​https://securityinabox.org/en/
● Tech Solidarity​, ​techsolidarity.org
○ Basic Security Guide, do and don’ts for basic security when using a laptop and/or
mobile device, ​techsolidarity.org/resources/basic_security.htm

SEARCH ENGINES WHICH PROTECT PRIVACY

● DuckDuckGo​, Internet search engine, protecting privacy, ​duckduckgo.com

● StartPage​, Internet search engine, protecting privacy, ​startpage.com
● Qwant​, Internet search engine, protecting privacy, ​qwant.com

Sources per Country

Iraq

Name Description Pros Cons Links

Provinces of the umap.openstreetmap.f

so-called Islamic r
State

Syria

Name Description Pros Cons Links

Maps lib.utexas.edu/maps/sy
ria.html

Opposition media See this excellent list reddit.com

compiled by Noor
Nahas of multimedia
sources from Syrian
opposition groups,

Provinces of the umap.openstreetmap.f

so-called Islamic r
State​,

 
12
 

Companies

BUSINESS REGISTRIES

● French SIRENE​, provided by ​Investigative Dashboard​, a queryable version of the french

RCS (Business registry), with OpenRefine reconciliation​​t​o​o​l​.
https://data.occrp.org/entities?filter:dataset=fr_sirene
● B​u​s​i​n​e​s​s​​r​e​g​i​s​t​r​i​e​s​​i​n​​E​u​r​o​pe ​ ​,​​on
​ ​​t​he​ ​​E​u​r​o​p​e​a​n​​e​-​J​u​s​t​i​c​e​​p​o​r​t​a​l​,​​l​i​n​k​s​​t​o​​t​h​e​​n​a​t​i​o​
n​a​
l
b​u​s​i​n​e​s​s​​r​e​g​i​s​t​r​y​​of​​​e​ac​​h​​E​U​​m​e​m​be ​ ​r​.
https://e-justice.europa.eu/content_business_registers_in_member_states-106-en.do

Expert/Source Tools
Name Description Pros Cons Link Guides

Expertise Finder Search engine for http://expertisefind

journalists to find er.com/
experts (currently
only academics in
USA and Canada),
contact
information on
page, no login,
30k experts listed

Expert Guide Academics open Australia only. http://www.expertg

to media in uide.com.au/
Australia:

Help a Reporter Post a query and https://www.helpar

Out experts reply, eporter.com/
mainly USA and
Canada, quality of
replies is hit or
miss

She Source Female experts, http://www.women

mainly USA. smediacenter.com
/shesource/

Speakezee Academics and https://www.speak

those with PhDs, ezee.org
mainly UK:

Expert File Mix of experts, https://expertfile.co

mainly USA and m
Canada:

 
13