Image OSINT is the work of establishing facts about a photo or video frame using the image itself and open sources: maps, satellite imagery, public archives and search engines. Most of the time the fact you want is where it was taken. Sometimes it is when, or whether this is the first copy, or whether it has been changed.
This guide follows the order that saves the most time. Preserve first, triage second, read the scene third, search for earlier copies fourth, confirm on a map fifth, and write it down throughout. It is written for people who need an answer they can defend, so most of it is about what stops a wrong answer from getting through.
The short version
Preserve the file. Triage in ten minutes. Rank anchors by how few places they fit. Search for earlier copies. Confirm with three independent fixed features on dated imagery. Then write down what you rejected, and how sure you are at each level: country, city, district, street.
01
Start with the file, not the picture
Before you look closely, save what you were given. A screenshot of a post is not the file, and a re-upload is not the original.
- Keep the original untouched. Work on copies. If you crop, rotate or enhance, do it on a duplicate and name it so you can tell the versions apart.
- Record the source. The page or account, the exact address, and the date and time you retrieved it. Pages change and posts disappear.
- Hash the file you analyzed. A SHA-256 hash lets you show later that the image you checked is the image you were handed.
- Check for metadata, and expect little. Most platforms remove location tags on upload, and anyone can edit the ones that remain. A tag that survives is a lead to test, never proof.
02
Triage before you commit hours
The costly mistake is spending an afternoon on a frame with nothing locatable in it. Give every image ten minutes of triage and sort it into one of three piles.
- Strong. Readable text, a distinctive fixed structure, a recognizable road layout or skyline, or terrain that is rare. These go to the front of the queue.
- Partial. Enough to narrow a country or region but not a place. Keep them, and write the limit next to the image.
- Weak. Close-ups, heavy crops, night shots with no light sources, tight interiors, generic suburban streets. Say so and move on unless the case depends on it.
If you want a number, score the image on six questions, each worth 0, 1 or 2. The score is a way to be consistent across a batch, not a measurement.
| Question | 0 | 1 | 2 |
|---|---|---|---|
| Is there readable text? | None, or too small to read | Fragments, or one word | Full words, names or numbers you can search |
| Is there a fixed structure? | Only moving or temporary things | A building or object that could be common | A distinctive building, bridge, tower or skyline |
| Is the road or ground visible? | No | Partly | Clear markings, kerbs and surface |
| Is there infrastructure? | None | A pole or sign, small in the frame | Several items: poles, signals, bollards, hydrants |
| Is there terrain or a horizon? | Flat, generic or hidden | Some relief or vegetation | A distinct ridge, coastline or landform |
| Is the image sharp and uncropped? | Heavy crop or compression | Some loss | Clean, full frame |
8 or more: strong. 4 to 7: partial. Under 4: record it as weak and move on.
A quick estimate tool helps here too, because it tells you which pile an image belongs in before you have spent the time. See the section on where AI helps, below.
03
Read the scene: anchors and how they fail
An anchor is a visible fact that rules places out. Rank them by how few places they fit, and expect each kind to fail in its own way.
| Anchor | What it rules out | How it misleads |
|---|---|---|
| Writing and script | Whole regions. Cyrillic, Arabic, Thai and Devanagari each point somewhere specific. | A language is not a border. Diaspora areas and tourist districts carry signs in other languages. |
| Road layout and markings | Countries. Driving side, centre line colour, edge lines and lane rules follow national standards. | Markings get repainted, and some neighbouring countries share styles. |
| Street furniture and utilities | Regions and sometimes cities. Pole material, insulators, bollards, kerbs and manhole covers are bought to local designs. | Easy to overlook, and standards change over decades. |
| Buildings | Climate zone and era. Roof pitch, wall material, window proportions and balconies. | Styles are exported and copied. One building tells you less than a street of them. |
| Plants and terrain | Latitude, elevation and climate. Palms, conifers, farmland and rock type. | Seasonal, and planted. A palm in a car park proves little. |
| Shadows and light | A rough time of day and direction. | Needs a known object height, level ground and a reliable date. Never a way to find the place. |
One anchor is a lead. A defensible answer needs several independent anchors that agree, and you should look just as hard for one that contradicts.
04
Search for earlier copies
Run the whole frame, then each distinct crop, through more than one reverse image search engine. They index different parts of the web. You are looking for three things: an earlier upload that contradicts the date you were given, a higher-resolution original, and a different photo of the same place.
A match tells you about the picture, not about the claim. If an earlier copy has a caption naming a city, treat the caption as a lead and confirm the place yourself. Captions get copied from one repost to the next. The OSINT image search guide covers this step in detail.
05
Narrow, then confirm on a map
Work as a funnel: continent, country, region, city, then street. At each step ask what would have to be true for the next step to be wrong.
Confirmation means matching fixed features between your image and imagery you can cite: road geometry, building outlines and rooflines, poles, the shape of a skyline, a bend in a river. Shop fronts and parked cars do not count. Check the capture date of the imagery you use, because a satellite view from three years ago can show a different street from the one in your photo.
- Aim for at least three independent features that agree.
- Use historical imagery to test whether the scene existed at the date claimed.
- Write down what you could not match. A feature that does not fit matters more than one that does.
06
Say how sure you are, level by level
Use the same four words every time, so a reader knows what each one costs you to claim.
| Word | Use it when | Evidence needed |
|---|---|---|
| Confirmed | Several independent features match dated imagery and nothing contradicts. | Three or more fixed features, a dated source, and at least one rejected alternative. |
| Strong | The evidence agrees and nothing contradicts, but you have not matched a precise spot. | Two independent anchors that agree. |
| Lead | One source or one anchor points here. | A single anchor, or a caption or tag you have not tested. |
| Not established | The image does not support an answer at this level. | None. Say so. |
State it per level: country, city, district, street, camera position. A photo can be confirmed to a city and not established to a street. Writing it that way is not weakness. It is what lets an editor or a client trust the part you are sure of. The worked example below uses these four words on a real, published photo, and stops where its evidence stops.
07
One photo, no place name
A street scene with no landmark and no readable street name. Here is how one published photo gets from a tram on a curve to a named city, and where the evidence stops. It is a Creative Commons photograph from Wikimedia Commons, so you can open the source and check each step.
Photo: Mdiagom · CC BY-SA 3.0 · Wikimedia Commons · Converted to WebP; no crop.
Markers added by Oceanir. Open the source to check every step yourself.
The tram's destination board
The board reads M. MONIZ and 28. A route number and a terminus are text, and text is searchable. This is the fastest clue in the frame, and it names a transit route, not a street.
A shop sign in Portuguese
CAFETARIA over a shop front. The spelling is Portuguese. That supports Portugal, but one word on one sign is a lead, not a country.
A tiled facade
A building front covered in blue glazed tiles, with stone window surrounds. It fits clue 2, but it does not narrow the place past the country on its own.
Tracks curving across cobbles
Two rails bend through a street paved in setts. This is fixed geometry. It can be matched against a map and street-level imagery, and it does not change with the season or the traffic.
Patterned pavement
A black and white stone mosaic on the footpath at the lower left. Its pattern and its curb are features to look for in imagery of a candidate street.
The investigation log
| Step | What was checked | Result |
|---|---|---|
| Read the scene | The board, the shop sign, the facade, the tracks | The board gives text to search. The sign suggests Portuguese. The tracks and the facade give geometry to match later. |
| Search the text | The words and number on the board | They lead to a numbered tram route and a terminus. The source page's categories name the same route, Carris route 28E (M. Moniz). Confirm it on the operator's own route map, not a repost. |
| Check the source | The Commons description and categories | They say Lisbon, Portugal, and the categories name Largo da Madalena. A source can be wrong, so the square is a lead, not proof. |
| Compare with imagery | The tiled building, the curve of the two tracks, the lamp posts | Match them against dated street-level views of Largo da Madalena. This photo is from 2005, so shop fronts and vehicles will not match today's imagery. |
| Document | Everything above | Save the source address, the retrieval date, the marked image and this log, so someone else can repeat each step. |
This is what a log for this photo looks like. Misses belong in it too.
What we can say, and how sure
| Level | Status | Note |
|---|---|---|
| Country and city | Strong | Lisbon, Portugal. A route board, a Portuguese word and the source agree. Nothing is matched to imagery yet. |
| Square | Lead | Largo da Madalena, from the source's categories. Needs a match to dated street-level imagery. |
| Date | Lead | 6 December 2005, from the file's own metadata as shown on the source page. Metadata can be wrong. |
| Camera position | Not established | Nothing in the frame fixes where the photographer stood. |
The lesson
A vehicle's route board is a fact you can search, and it can name a city faster than any building. Even so, the source's location stays a lead until it is matched to dated imagery, and in a 2005 photograph the shop fronts will have changed.
08
Where shadows and weather fit
Chronolocation tests a candidate. It does not find one. Once you have a candidate place, a sun position tool can tell you whether the shadows fit the claimed date and time. Weather and season add a second check: snow, foliage, flowering and crop stages narrow the time of year. Treat both as consistency checks and say so in your notes.
09
Write it down as you go
A location is only useful to a team if someone else can follow how you reached it. Keep one short record per image.
- The source, the retrieval date and a hash of the analyzed file.
- The anchors you used, with a crop of each.
- The candidates you rejected, and the reason for each.
- The imagery that confirmed the match, its date, and the features that lined up.
- What the image supports (a street, a district, a city) and what it does not, with your confidence in plain words.
IMAGE RECORD
File name:
SHA-256:
Source (address or account):
Retrieved (date, time, timezone):
Original or copy:
CLAIM BEING TESTED
What the source says about place and date:
ANCHORS
1. [what it is] [where in the frame] [what it rules out]
2.
3.
EARLIER COPIES
Engines used:
Earliest copy found (address, date):
Differences from my copy:
CANDIDATES
Candidate 1: [confirmed / strong / lead / rejected] Why:
Candidate 2:
Candidate 3:
CONFIRMING IMAGERY
Source and capture date:
Features matched:
Features that do not match:
CONCLUSION
Country: Confidence:
City: Confidence:
District: Confidence:
Street: Confidence:
Camera spot: Confidence:
NOT ESTABLISHED
10
Mistakes that sink an answer
- Anchoring on the first guess. Once you believe it is a particular city, every feature starts to look like it fits. Write down two alternatives before you start confirming.
- Confirming with one feature. A matching building is not a matching street.
- Trusting the caption. Captions and comments are claims to test.
- Relying on stale imagery. Check the date before you trust what a map shows.
- Claiming more precision than the image supports. If it supports a district, say district.
- Not recording dead ends. The next reviewer will repeat your work.
11
Where AI estimation helps, and where it does not
AI estimation is most useful at two points. At triage, it tells you quickly whether an image has anything to work with. At shortlisting, it gives you ranked places to test instead of an empty map. It is least useful as a final answer. A ranked list is a set of hypotheses, and every one still needs confirming against imagery you can cite.
Oceanir's free scan returns a suggested place on a map with a confidence level and the clues behind it, and deeper checks add ranked candidates and street-level comparison. It does not guarantee an exact location, and when a photo only supports an area, it says so. You need a free account to run a scan, and you can turn saved history off.
12
Questions
Do I need special software for image OSINT?
No. A browser, a mapping service with satellite and street-level views, a reverse image search engine and a notes document cover most work. Specialist tools save time on particular steps, and the OSINT geolocation toolkit lists them by job.
How long does a geolocation take?
From a few minutes for a frame with a readable sign to days for one with nothing but terrain. Triage exists so you know which you have before you start.
Can you do this without GPS data?
Yes, and you usually have to. Platforms strip location tags, so the place has to come from what is visible.
Is it legal?
Working from publicly available images with open sources is standard practice in journalism, law and security research. Legality depends on your jurisdiction and on how the image was obtained and used. This is general information, not legal advice.