Tailstails.net
Amnesic live operating system that boots from USB, routes everything through Tor and leaves no trace on the host computer.
setup
Not lookup tools. This is the environment you investigate from. Get it right before you touch a target, because mistakes here can expose you or ruin your evidence.
isolated environment
Keep investigations off your own machine and identity. Use a separate browser at minimum, and ideally an amnesic OS or a dedicated VM.
Tor Browsertorproject.org
Hardened Firefox that routes traffic through the Tor network. Needed for onion services and for hiding your IP from investigation targets.
Don't log into personal accounts in Tor Browser, and don't resize the window. Both make you easier to fingerprint.
Trace Labs OSINT VMgithub.com
Kali-based virtual machine preloaded with OSINT tools, built by Trace Labs for missing-persons search parties and CTFs.
Snapshot the VM in a clean state and roll back after each investigation so cookies and artifacts don't carry over.
Whonixwhonix.org
Two-VM Debian-based OS (gateway plus workstation) that forces all traffic through Tor, so IP leaks are prevented even if an app is compromised.
capture & evidence
Record what you saw, when and where, before it changes or disappears.
Hunchlyhunch.ly
Browser extension and desktop app that automatically captures, hashes and timestamps every page you visit during an investigation.
Hunchly "selectors" alert you when a tracked name, email or number appears on any page you visit. Set them at the start of a case.
sock puppets
Research accounts that are not linked to you. Keep each persona consistent and check the platform rules first.
Fake Name Generatorfakenamegenerator.com
Generates consistent fictitious identities (name, address, DOB, occupation) by country, which helps when building sock-puppet personas.
This Person Does Not Existthispersondoesnotexist.com
Serves a new GAN-generated face of a non-existent person on every refresh, usable as a sock-puppet avatar.
GAN faces have known tells (aligned eye position, warped earrings or backgrounds), and platforms increasingly detect them. Edit or crop before use.