> Methods for open-source investigation: what an email, a username, a photo, a domain or a company record can tell you, and how to work with it lawfully. Blog # Blog Methods for open-source investigation: what an email, a username, a photo, a domain or a company record can tell you, and how to work with it lawfully. 8 articles ยท 6 topics - [Geolocating a photo or a point on the map](https://pandorasearch.com/blog/geolocate-a-photo-or-a-point-on-the-map/): How to place a photo using clues in the scene, OpenStreetMap and Overpass, street-level imagery and shadows, and where the ethical limits lie. - [Checking breach exposure without touching passwords](https://pandorasearch.com/blog/check-breach-exposure-without-touching-passwords/): Using Have I Been Pwned, XposedOrNot and LeakCheck to measure an email's breach exposure, and why handling leaked passwords crosses a line. - [OSINT and the GDPR: investigating within the law](https://pandorasearch.com/blog/osint-and-gdpr-investigating-within-the-law/): Lawful basis, purpose limitation, minimisation, special categories and audit trails: how to apply the GDPR to an OSINT investigation. - [Who runs a company: BORME, Companies House and OpenCorporates](https://pandorasearch.com/blog/who-runs-a-company-borme-companies-house/): How to find out who runs a company in Spain and the UK using BORME, Companies House and OpenCorporates, without mixing up namesakes. - [Domain and IP reconnaissance with open sources](https://pandorasearch.com/blog/domain-and-ip-reconnaissance/): DNS, RDAP, Certificate Transparency, passive DNS, exposed services and reputation feeds: a passive method for analysing a domain or IP. - [Reverse image search and photo metadata](https://pandorasearch.com/blog/reverse-image-search-and-photo-metadata/): EXIF metadata, why social networks strip it, reverse image search and perceptual hashing to find the same photo, without facial recognition. - [Searching a username across hundreds of sites](https://pandorasearch.com/blog/search-a-username-across-hundreds-of-sites/): How WhatsMyName, Sherlock and Maigret work, why they return false positives, and how to tell whether two accounts with one handle share an owner. - [How to investigate an email address with OSINT](https://pandorasearch.com/blog/how-to-investigate-an-email-address-with-osint/): What open sources reveal about an email address: provider and MX, Gravatar, registered services, breach exposure, and how to corroborate it. --- Page: https://pandorasearch.com/blog/