Resources

Books and booklets

The book grew out of the notes I kept while studying for GOSI. Each booklet follows one case from start to finish. 3 files

• OSINT, Step by Step

  A book that walks through open-source investigation step by step. Eighteen method chapters are followed by nine real cases.

  Book, 27 chapters, 2026, Web page

• Is this video from today?

  I check a dashcam video that spread as “just now” after the Sanriku earthquake. It turns out to be from the 2024 Noto earthquake.

  Free booklet, 11 pages, 2026

• Where is this wave?

  I find the roof used to film a 2011 tsunami video that spread again in 2026, using 2011 aerial photos and open maps.

  Free booklet, 17 pages, 2026, Web page

Tool handbooks

Each one uses a tool step by step on a real input. Screenshots are marked. 25 files

• Checking an indicator with the IOC Lookup desk

  PDF, 5 pages, 0.4 MB, Tool page

• Drafting rules with the Ready Detection Pack

  PDF, 6 pages, 0.5 MB, Tool page

• Finding shared traces across evidence packages

  PDF, 6 pages, 0.5 MB, Tool page

• Finding the instructions and permissions in an agent repository

  PDF, 7 pages, 0.6 MB, Tool page

• Getting to know an unknown file without running it, with the File and document sandbox

  PDF, 5 pages, 0.3 MB, Tool page

• Prioritising a CVE with the Actively Exploited CVEs desk

  PDF, 6 pages, 0.4 MB, Tool page

• Reading a file's identity, history and traces with the Visual and video evidence lab

  PDF, 8 pages, 1.3 MB, Tool page

• Reading a group on the Threat actors page

  PDF, 7 pages, 0.8 MB, Tool page

• Reading a page's history with the Web Archive Desk

  PDF, 7 pages, 0.6 MB, Tool page

• Reading a signed Android lab record with Mobile Behavior Diff

  PDF, 5 pages, 0.4 MB, Tool page

• Reading an Android vulnerability the right way with the Android Threat Desk

  PDF, 5 pages, 0.5 MB, Tool page

• Reading what changes over time in a video or audio file with ShadowTrace

  PDF, 7 pages, 0.7 MB, Tool page

• Reading your own domain's outside footprint

  PDF, 5 pages, 0.4 MB, Tool page

• Recording a public page with the Web Evidence Recorder

  PDF, 7 pages, 0.8 MB, Tool page

• Reviewing an APK without running it, with Mobile Exposure Graph

  PDF, 5 pages, 0.4 MB, Tool page

• Reviewing an n8n change with ReleaseGuard before it goes live

  PDF, 6 pages, 0.6 MB, Tool page

• Seeing quiet corrections in public sources

  PDF, 6 pages, 0.5 MB, Tool page

• Seeing what a page loads from elsewhere with Web Supply Chain

  PDF, 5 pages, 0.5 MB, Tool page

• Seeing where a link really goes with Redirect Chain

  PDF, 5 pages, 0.5 MB, Tool page

• Setting up a monitoring case with OSINT Runbook

  PDF, 7 pages, 0.7 MB, Tool page

• Testing whether a photo fits a claimed place and time with Shadow verification

  PDF, 5 pages, 0.5 MB, Tool page

• Watching a page over time with the Web Change Monitor

  PDF, 5 pages, 0.5 MB, Tool page

• Workflow Clinic from start to finish

  PDF, 6 pages, 0.6 MB, Tool page

• Writing a finding down with its source

  PDF, 4 pages, 0.4 MB, Tool page

• Writing a short research report with the Report Builder

  PDF, 5 pages, 0.5 MB, Tool page

How it was built

Short notes on what a tool does and why, its limits and its architecture. 14 files

• How Deep Analysis is built

  PDF, 5 pages, 0.4 MB, Tool page

• How Event Desk is built

  PDF, 6 pages, 0.7 MB, Tool page

• How Exposure Watch is built

  PDF, 5 pages, 0.5 MB, Tool page

• How ShadowTrace is built

  PDF, 7 pages, 0.7 MB, Tool page

• How the CSINT Community is built

  PDF, 6 pages, 0.4 MB, Tool page

• How the file and document review is built

  PDF, 4 pages, 0.5 MB, Tool page

• How the GEOINT page is built

  PDF, 5 pages, 0.4 MB, Tool page

• How the GOSI-Ready OSINT VM is built

  PDF, 5 pages, 0.6 MB, Tool page

• How the n8n AI Security Regression Gate is built

  PDF, 6 pages, 0.4 MB, Tool page

• How the ReleaseGuard handoff check is built

  PDF, 9 pages, 1.1 MB, Tool page

• How the ReleaseGuard public-source case was built

  PDF, 7 pages, 0.9 MB, Tool page

• How the research graph is built

  PDF, 6 pages, 0.6 MB, Tool page

• How the threat intelligence pipeline is built

  PDF, 5 pages, 0.5 MB, Tool page

• How the web evidence recorder is built

  PDF, 6 pages, 0.6 MB, Tool page

Research data

Raw records, so you can check a result in a file yourself. 2 files

• Mullvad VPN live test data

  Anonymised pcap captures, measurement logs, the graph script and a README for the nine tests in the video.

  ZIP, 1.7 MB, Research file

• Manavgat fire, satellite review

  Sentinel-2 images of the same two slopes 25 days apart, the counting method and its limits (Turkish PDF).

  PDF in Turkish, 12 pages, 4 MB, Research file

About me and maps

• Ahmet Göker handbook

  Who I am, what I do and how I examine a case, in 16 pages.

  PDF, 16 pages, 2.3 MB

• Project architecture map

  What each tool I wrote is for and how they connect.

  PDF

Working environment and directories

• GOSI-Ready OSINT VM

  A rebuildable Ubuntu environment for legal OSINT practice. Release packages come with SHA-256 records.

  Download page

• OSINT source directory

  Outside sources I reviewed for verification, archives and security work.

  Directory

• RSS feed

  Lists new research files and site updates.

  RSS