A Practical Starter Stack for New OSINT Practitioners

This starter stack teaches sequence before tool collecting. New practitioners need habits that work across cases: search carefully, preserve evidence, verify entities, then widen the investigation only when the lead deserves it.

Use this stack when

The operator is still building a repeatable workflow and needs tools that make the evidence chain visible rather than overwhelming them with advanced pivots.

Recommended sequence

• Start with Advanced Search Operators Workflow and Wayback Machine to build disciplined discovery and preservation habits.
• Use OpenCorporates, Epieos, and Hunter when the lead becomes an entity, person, or domain-linked contact.
• Use SecurityTrails and Shodan only after the case needs technical context.
• Use SpiderFoot and Maltego later, when automation or graphing adds clarity instead of noise.

Branch out only when the evidence requires it

• Use OSINT Framework as a map of possible source categories, never as evidence or a ranking of tools.
• Use OpenRefine after research has produced a messy table of names, addresses, entities, or identifiers that needs reproducible cleanup.
• Use FOCA when original public documents may contain useful metadata, and treat usernames, paths, or software traces as clues rather than attribution.

Editorial guardrail

The point is not to master every platform immediately. It is to learn why each tool earns a place in the workflow and what evidence still needs corroboration.