Show your working: notes and evidence capture in OSINT

A finding you cannot show your working for is an anecdote. This guide covers why OSINT analysts keep a research log, what to record, and how to capture, archive and hash what you find, with a fictional log extract.

Photo: Yen Vu / Unsplash

What it is

Evidence capture means recording what you found, where, when and how, as you find it: a log, a saved copy of the page, and enough detail for someone else to repeat your steps. One line per finding is enough.

The Association of Chief Police Officers (ACPO) Good Practice Guide for Digital Evidence (2011), written for law enforcement, says every process applied to digital evidence should leave an audit trail (a record of each step taken), and an independent examiner following it should “achieve the same result”. The same logic holds for due diligence, HR investigations and security reviews.

Why it matters for an OSINT analyst

• Repeatability. Pages change and posts vanish; your log may be the only record.
• Defensibility. When someone asks “how do you know?”, show them.
• Disclosure. In England and Wales, the code of practice under the Criminal Procedure and Investigations Act 1996 (CPIA) requires police investigators to record potentially relevant information in “durable or retrievable form”. Negative information (such as searches that found nothing) is often relevant, and where it may be relevant it must be recorded. Others with a duty to investigate crime should have regard to the code. Crown Prosecution Service (CPS) guidance: if in any doubt, record and keep it. Most private-sector analysts are not bound by this, but it is a sound model.
• Audit trail. Under UK GDPR the controller (whoever decides why and how personal data is used) must be able to demonstrate compliance.

How to do it

1. Open the log before your first search. A spreadsheet will do.
2. Record the time with a time zone. The UK is on British Summer Time (BST, UTC+1) until the clocks go back on 25 October 2026, then Greenwich Mean Time (GMT). Write 10:12 BST, never 10:12.
3. Log the search, not just the result. Engine, exact query, outcome: Bing | "Harrowgate Freight" "data breach" | 0 results. Nil results are the ones people forget, and the ones they get asked about later.
4. Take a full-page screenshot.
   • Firefox: right-click the page, choose Take Screenshot, then Save full page (or press Ctrl+Shift+S, Cmd+Shift+S on a Mac). Firefox names the file by date, time and page title, like Screenshot 2026-09-22 at 10-11-40 Careers - Harrowgate Freight.png (fictional).
   • Chrome: open the developer tools, DevTools (F12; Cmd+Option+I on a Mac), press Ctrl+Shift+P (Cmd+Shift+P) for the Command Menu, type screenshot and choose the full-size option. Chrome documents the option under More options in Device Mode. Wording varies between versions.
5. Archive it. Paste the URL into Save Page Now on the Internet Archive’s Wayback Machine at archive.org/web. It saves that one page, not the whole site, and gives you a permanent link. The link is a 14-digit GMT timestamp (yyyymmddhhmmss) followed by the archived address, for example https://web.archive.org/web/20260922091230/https://harrowgate-freight.example/careers (fictional). A page archived at 10:12 BST therefore carries 09:12 in its link. Log it in full.
6. Hash anything you download. A hash is a file’s fingerprint: alter one byte and it changes. Log the algorithm and the whole result.
   • Windows PowerShell: Get-FileHash .\HGF-002_2026-09-22_1011BST_careers.png -Algorithm SHA256 (SHA-256 is the default).
   • Windows Command Prompt: certutil -hashfile HGF-002_2026-09-22_1011BST_careers.png SHA256.
   • macOS Terminal: shasum -a 256 HGF-002_2026-09-22_1011BST_careers.png (without -a 256 it uses SHA-1).
7. Name files consistently. Reference, date, time, zone, description: HGF-002_2026-09-22_1011BST_careers.png. No colons; Windows forbids them.
8. Work on copies. Keep the original read-only and annotate a duplicate (…_careers_annotated.png). Hash the original, never the copy.
9. Store securely and delete on schedule. Keep only the personal data you need, protect it, and justify how long you keep it. Log the deletion date.

Worked example (fictional)

Harrowgate Freight Ltd, a fictional client, asked what its website gives away. Three lines from the log:

Ref	Date/time	Action	URL	Finding	Capture	Archive / SHA-256
HGF-001	2026-09-22 10:04 BST	Google: site:harrowgate-freight.example filetype:pdf	Results page	3 PDFs indexed	HGF-001_2026-09-22_1004BST_results.png	Not archived. 9c1e…07a4
HGF-002	2026-09-22 10:11 BST	Opened careers page	https://harrowgate-freight.example/careers	Job advert names depot software “FleetDesk” and version	HGF-002_2026-09-22_1011BST_careers.png	web.archive.org/web/20260922091230/… 4b7d…e21c
HGF-003	2026-09-22 10:26 BST	Opened PDF from HGF-001	…/downloads/driver-handbook.pdf	Page 14 lists staff names and mobiles. Stopped, not saved. Client told	None	Not archived. Personal data

All data is fictional; hashes shortened.

HGF-003 is the line beginners leave out. Deciding not to capture something, and recording why, is part of the record.

Figure: OAT teaching graphic. Fictional data.

The OAT view Anyone can learn to find things online in an afternoon. What makes it professional is a record someone else can retrace. If an analyst’s notes would not survive a colleague’s review, we would not let them near a live case.

Common beginner mistakes

• Screenshots with no URL or time zone. Firefox’s default file name has date, time and title, not address or zone.
• Hoarding personal data. The Information Commissioner’s Office (ICO) is clear: no collecting personal data on the off-chance it is useful later. Publicly available personal data still carries individuals’ rights.
• Archiving without thinking. Save Page Now puts a permanent copy in a public archive. Never archive pages holding personal details.

Next steps

Print the top tips sheet and open a log before your next search.

The legal bit

The Computer Misuse Act 1990 makes it an offence to cause a computer to perform a function intending to secure access you know is unauthorised; using someone else’s login or getting round access controls risks exactly that. UK GDPR and the Data Protection Act 2018 still apply to public data: have a purpose, be proportionate, record your reasons.

Key takeaways

• Log every search, including the ones that found nothing, with a time zone.
• Pair each screenshot with URL, archive link and hash.
• Work on copies and leave originals untouched.
• Collect only the personal data you need, secure it, and delete it on schedule.
• If you find something that should not be public, stop. Do not download it. Tell the owner.

Want to go further?

OSINT is easy to start and hard to do properly. We teach the hard part. Recording and reporting run through the whole course. Find out about our Level 3 Award in OSINT at obsidianarctraining.com.