Build a Dedicated OSINT Investigation Workstation

┌─────────────────────────────────────────────────────────────┐
│                    Host Machine                              │
│                    (Your daily driver)                       │
│                                                             │
│  ┌────────────────────────────────────────────────────────┐ │
│  │              OSINT Investigation VM                    │ │
│  │                                                        │ │
│  │  ┌──────────┐  ┌──────────┐  ┌──────────┐            │ │
│  │  │ Firefox  │  │ Firefox  │  │ Firefox  │            │ │
│  │  │Profile A │  │Profile B │  │Profile C │            │ │
│  │  │(Case #1) │  │(Case #2) │  │(Sock     │            │ │
│  │  │          │  │          │  │ Puppet)  │            │ │
│  │  └──────────┘  └──────────┘  └──────────┘            │ │
│  │                                                        │ │
│  │  ┌──────────┐  ┌──────────┐  ┌──────────┐            │ │
│  │  │  Maltego │  │SpiderFoot│  │ Recon-ng │            │ │
│  │  └──────────┘  └──────────┘  └──────────┘            │ │
│  │                                                        │ │
│  │  ┌─────────────────────────────────────┐              │ │
│  │  │    VPN (Investigation-specific)     │              │ │
│  │  │    Exit node: Different from home   │              │ │
│  │  └─────────────────────────────────────┘              │ │
│  └────────────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────────┘

# Start with Ubuntu 22.04 LTS minimal installation
# After install, update system
sudo apt update && sudo apt upgrade -y
 
# Install essential OSINT tools
sudo apt install -y \
    firefox \
    chromium-browser \
    tor \
    torbrowser-launcher \
    whois \
    dnsutils \
    nmap \
    python3-pip \
    git \
    curl \
    wget \
    jq \
    exiftool \
    mat2 \
    httrack \
    metagoofil
 
# Install Python OSINT tools
pip3 install \
    theHarvester \
    shodan \
    censys \
    holehe \
    socialscan \
    maigret \
    ghunt

# Maltego Community Edition
wget https://maltego-downloads.s3.us-east-2.amazonaws.com/linux/Maltego.v4.6.0.deb
sudo dpkg -i Maltego.v4.6.0.deb
 
# SpiderFoot
git clone https://github.com/smicallef/spiderfoot.git
cd spiderfoot
pip3 install -r requirements.txt
 
# Recon-ng
sudo apt install -y recon-ng
 
# Amass
sudo snap install amass
 
# Sherlock (username search)
git clone https://github.com/sherlock-project/sherlock.git
cd sherlock
pip3 install -r requirements.txt

# Create investigation-specific profiles
firefox -CreateProfile "case-001"
firefox -CreateProfile "case-002"
firefox -CreateProfile "sock-puppet-01"
 
# Launch with specific profile
firefox -P "case-001" -no-remote &

# Install OpenVPN
sudo apt install -y openvpn
 
# Import VPN configuration
sudo openvpn --config /path/to/investigation-vpn.ovpn
 
# Verify VPN is active (IP should be different from home)
curl -s https://api.ipify.org
curl -s https://ipinfo.io/json | jq

# Configure DNS to use VPN's DNS servers
sudo bash -c 'echo "nameserver 1.1.1.1" > /etc/resolv.conf'
sudo bash -c 'echo "nameserver 9.9.9.9" >> /etc/resolv.conf'
 
# Test for DNS leaks
# Visit: https://dnsleaktest.com

# UFW-based kill switch — only allow traffic through VPN
sudo ufw default deny outgoing
sudo ufw default deny incoming
sudo ufw allow out on tun0  # VPN interface
sudo ufw allow out to 10.0.0.0/8  # Allow local VM network
sudo ufw allow out to <VPN_SERVER_IP> port 1194 proto udp  # Allow VPN connection
sudo ufw enable

# Create case template
mkdir -p ~/investigations/CASE-{001..010}/{evidence,screenshots,reports,notes,tools}
 
# Case directory structure:
# ~/investigations/
# └── CASE-001/
#     ├── evidence/          # Downloaded files, exports
#     ├── screenshots/       # Time-stamped screenshots
#     ├── reports/           # Final investigation reports
#     ├── notes/             # Investigation notes
#     ├── tools/             # Case-specific scripts
#     └── case-log.md        # Timeline of investigation actions

#!/bin/bash
# screenshot.sh — Take timestamped screenshots for evidence
# Usage: ./screenshot.sh <case-number> <description>
 
CASE="${1:-CASE-001}"
DESC="${2:-screenshot}"
TIMESTAMP=$(date +"%Y%m%d_%H%M%S")
FILENAME="${TIMESTAMP}_${DESC}.png"
DEST="$HOME/investigations/${CASE}/screenshots/${FILENAME}"
 
# Take screenshot (requires scrot or gnome-screenshot)
scrot "$DEST"
echo "Saved: $DEST"
 
# Log the screenshot
echo "${TIMESTAMP} | Screenshot: ${DESC} | ${FILENAME}" >> \
    "$HOME/investigations/${CASE}/case-log.md"

"""Automated evidence collection for OSINT investigations."""
 
import json
import subprocess
from datetime import datetime
from pathlib import Path
 
 
class InvestigationCase:
    def __init__(self, case_id: str):
        self.case_id = case_id
        self.base_path = Path.home() / "investigations" / case_id
        self.base_path.mkdir(parents=True, exist_ok=True)
        for subdir in ["evidence", "screenshots", "reports", "notes"]:
            (self.base_path / subdir).mkdir(exist_ok=True)
 
    def log_action(self, action: str):
        """Log investigation action with timestamp."""
        timestamp = datetime.now().strftime("%Y-%m-%d %H:%M:%S")
        log_file = self.base_path / "case-log.md"
        with open(log_file, "a") as f:
            f.write(f"| {timestamp} | {action} |\n")
 
    def save_evidence(self, filename: str, data: str):
        """Save evidence file."""
        filepath = self.base_path / "evidence" / filename
        with open(filepath, "w") as f:
            f.write(data)
        self.log_action(f"Saved evidence: {filename}")
 
    def run_whois(self, domain: str):
        """Run whois lookup and save results."""
        result = subprocess.run(
            ["whois", domain], capture_output=True, text=True
        )
        self.save_evidence(f"whois_{domain}.txt", result.stdout)
        return result.stdout
 
    def run_dns_enum(self, domain: str):
        """Run DNS enumeration and save results."""
        records = {}
        for rtype in ["A", "AAAA", "MX", "NS", "TXT", "SOA"]:
            result = subprocess.run(
                ["dig", domain, rtype, "+short"],
                capture_output=True, text=True,
            )
            records[rtype] = result.stdout.strip().split("\n")
        self.save_evidence(
            f"dns_{domain}.json",
            json.dumps(records, indent=2),
        )
        return records
 
 
# Usage
if __name__ == "__main__":
    case = InvestigationCase("CASE-001")
    case.log_action("Investigation started")
    case.run_whois("example.com")
    case.run_dns_enum("example.com")

## Sock Puppet: [Alias Name]
 
**Created:** [Date]
**Purpose:** [Investigation case or general use]
 
### Identity
- Name: [Full name]
- Location: [City, Country]
- Occupation: [Cover story]
- Interests: [Relevant to investigation]
 
### Accounts
- Email: [email]
- Phone: [VoIP number if needed]
- Social Media: [list platforms]
 
### Technical
- Firefox Profile: [profile name]
- VPN Exit: [country/city]
- Browser fingerprint: [user agent string]
 
### Usage Log
| Date | Platform | Activity |
|------|----------|----------|