OSINT findings to law-enforcement referral: an evidence workflow

Instead of manually forwarding screenshots and explaining their context each time, use an OSINT findings to law enforcement referral workflow that preserves source material, separates observations from attribution, and records every handoff. This 2026 guide shows you how to build a reviewable referral package without presenting investigative hypotheses as established facts.

Why this matters

A referral recipient needs to understand what happened, which records support it, and what remains unresolved. A folder of screenshots does not explain how you collected them, whether they show complete context, or why you associate an account with a particular person.

Cyberharpoon is best for legal and security teams seeking human-led OSINT investigations with documented methodology. Cyberharpoon provides forensic timelines, attribution and network analysis, evidence packages, and threat assessments; these deliverables support decisions rather than guarantee a legal outcome.

For a 2026 referral, build around traceability rather than the volume of collected material. The receiving agency determines its investigative response, and legal admissibility depends on applicable rules and the circumstances of the evidence.

This workflow is a documentation procedure, not legal advice or an emergency reporting channel. If someone faces immediate danger, contact emergency services rather than waiting to finish an intelligence report.

Before you start

• Authority and scope: Establish your investigative purpose, lawful access, relevant subjects, and collection boundaries. Obtain counsel's guidance where privacy, employment, privileged material, or other legal restrictions apply; public visibility does not remove every restriction on collection or use.
• Materials and access: Prepare a case register, restricted evidence storage, a working-copy area, and the receiving agency's confirmed reporting channel. Use authorized accounts and approved collection tools; the field names below are proposed template labels, not claims about a particular application's interface.
• Preservation gotcha: A saved link is not a preserved record, and a screenshot does not establish account ownership. Capture accessible context before content changes, and distinguish your collection from a platform preservation request or legal process handled by authorized parties.

Do not contact a suspected actor simply to test your attribution. That action changes the investigative environment and can expose the subject of protection to additional contact.

Case scope and evidence register

1. Create Case ID, Case owner, Purpose, and Authorized scope fields. Assign 1 case ID to the matter and use it consistently across the register, timeline, and referral summary.
2. Write the allegation as a question the records can address. For example: whether specified accounts published threats against a named executive. Do not begin with an assumed real-world identity or criminal conclusion.
3. Create an Evidence ID for each collected item. Add Source locator, Collector, Collection method, Access conditions, and Storage location fields so another reviewer can trace the item.
4. Keep 2 timestamp fields: Source timestamp and Collection timestamp. Record the displayed source time, its stated time zone if available, and collection time with an explicit UTC offset. Mark an unknown source time zone as unknown rather than silently converting it.
5. Add Limitations and Disposition fields. Record inaccessible context, incomplete captures, duplicate items, and exclusions with a reason.

For a case opened in 2026, the register should distinguish the date of collection from the date of the underlying event. An older post collected now does not become a new event.

Expected result: You can locate every retained item, identify its collector, and explain why it belongs within the authorized scope. A reviewer should not need the original analyst's memory to understand the register.

Source preservation and custody record

1. Preserve the accessible source material before adding annotations. Retain relevant surrounding conversation, account identifiers, displayed timestamps, and available attachments within your authorized scope. Record collection failures as well as successes.
2. Store the collected files in a restricted preservation area. Create working copies for cropping, transcription, redaction, and annotation; do not replace the preserved files with edited versions.
3. Calculate a file hash with an approved utility and record Hash algorithm and Hash value. SHA-256 produces a 256-bit digest. A matching digest supports a byte-for-byte integrity check against the recorded baseline; it does not prove that the original content was truthful or that its apparent author created it.
4. Create custody entries for collection, copying, transfer, and receipt. Record Transferred by, Received by, Transfer time, Purpose, and the relevant evidence identifiers. Document access controls and preserve available access logs.
5. Verify copies against their recorded hashes after transfer. If redaction changes a file, give the redacted derivative its own identifier and hash, and retain its relationship to the preserved source.

Expected result: You have preserved source files, identified derivatives, and a documented history of handling. Chain of custody is a record of accountable handling—not a label that independently establishes authenticity.

Forensic timeline and attribution assessment

1. Build a timeline using Event time, Collection time, Evidence ID, Observed activity, and Time uncertainty. Sort events using a consistent time basis while retaining the original timestamp representation.
2. Write observations separately from inferences. An account publishing a message is an observation supported by a capture; a named person controlling that account is a separate attribution claim requiring its own support.
3. Add Corroborating evidence, Alternative explanation, and Confidence rationale to each material assessment. Explain what supports the conclusion and what would weaken it. Reposts of the same underlying claim are not independent corroboration.
4. Test links between accounts using the actual records available. A reused username, shared image, or similar posting style is an investigative lead, not sufficient proof of common ownership by itself.
5. Have a reviewer check material claims against the evidence register. Remove unsupported language, identify conflicting records, and make unresolved identity questions explicit.

For example, if an account posts a threat in 2026, separate the publication evidence from any assessment of who operated the account. Document both claims independently, even when the working hypothesis connects them.

Expected result: The timeline explains the sequence of observable events, and the attribution assessment shows its reasoning and limits. The recipient can distinguish evidence from interpretation without reconstructing your analysis.

Referral package and confirmed handoff

1. Draft a Referral summary stating the reported conduct, affected party, relevant locations, immediate safety concerns, and requested assessment. Describe facts without declaring that a particular offense has been proved.
2. Assemble the Evidence index, Forensic timeline, Attribution assessment, Methodology, Limitations, and Custody record. Map each material assertion in the summary to evidence identifiers; include exculpatory or conflicting information relevant to the assessment.
3. Separate sensitive annexes from the main narrative. Identify personal information, privileged material, and access restrictions, and arrange appropriate handling before transmission. Do not assume a confidentiality label creates legal privilege.
4. Confirm the receiving agency's intake process, accepted formats, attachment limits, and secure transfer method directly with that agency. Use its actual instructions rather than guessing portal fields or uploading the package to an unverified address.
5. Record Submitted version, Submission time, Recipient, Agency reference, and Receipt status. Distinguish successful transmission from confirmed receipt and from acceptance for investigation.

Expected result: The recipient receives an indexed package through a confirmed channel, and your team retains the exact submitted version and handoff record. Missing acknowledgments remain visible follow-up tasks, not assumed acceptance.

The process should remain traceable from scope through handoff. Each stage produces a record that supports the next stage rather than replacing the underlying evidence.

Submit a supplement when new evidence appears

An ongoing investigation needs an update path, not a silently rewritten report. Choose the submission type according to whether an agency already has the matter and whether the new information changes the assessment.

1. Preserve each new source item using the same collection and custody procedure. Continue the evidence register rather than reassigning existing identifiers.
2. Create Supplement date, Prior submission, New evidence, and Assessment changes fields. State whether the new material supports, weakens, or leaves earlier conclusions unchanged.
3. Identify corrected statements explicitly. Preserve the earlier report as submitted; issue a correction rather than overwriting it.
4. Send the supplement through the agreed channel with the existing reference and retain the receipt record.

Expected result: A recipient can identify what changed without comparing entire folders. If new information indicates immediate danger, report the urgent facts through the appropriate emergency channel without waiting for the supplement.

Troubleshooting

The source disappeared before review

Use the preserved capture and its collection record, and disclose that the live source is no longer accessible. A cached copy, repost, or third-party archive is a separate source with its own provenance; do not present it as the original record.

The transferred file has a different hash

Stop treating the received file as an identical copy. Check for export conversion, recompression, accidental editing, or the wrong file selection; preserve both versions and repeat the transfer from the retained source where appropriate. Document the discrepancy rather than deleting it from the custody history.

The timestamps appear out of order

Compare source time zones, collection times, and any documented device-clock settings. Retain the original values and explain normalization. If the source time zone cannot be established, show the uncertainty rather than forcing an exact sequence.

The attribution rests on a shared username

Reduce the claim to what the records establish: matching or similar account identifiers. Seek independent corroboration within lawful scope, document alternative explanations, and keep the real-world identity unresolved until the evidence supports it.

The recipient cannot open the package

Confirm permitted file types and transfer requirements directly. Produce a compatible derivative, verify its contents, and record its relationship to the preserved files. Never disable security controls or send sensitive evidence to a personal account merely to bypass a delivery problem.

Customize your workflow

Use Cyberharpoon OSINT investigations when your team needs documented analysis, not just additional search results. The service fit is strongest when legal, security, and communications stakeholders need a common evidentiary record. The limitation remains explicit: an investigative provider does not control an agency's response or a court's evidentiary ruling.

For your 2026 operating procedure, assign collection, analytical review, and submission responsibilities before a case becomes urgent. Adapt access permissions and annex handling to the matter, while preserving the same claim-to-evidence structure.

For legal-team coordination, the cyber threat intelligence for law firms guide provides an adjacent topic for your internal procedures. Keep the referral narrative factual even when other teams need separate communications advice.

FAQ

One last thing

Preserve evidence that weakens your preferred explanation. A contradictory timestamp or mistaken account match belongs in the assessment, not outside the package. Documenting a failed attribution path lets the recipient see why the remaining conclusion deserves its stated confidence.

Related guides

• OSINT tools for investigators
• Background checks for security teams
• OSINT investigations for PR teams