The page, machine transcript, interpretation and custody history are separate evidential layers.
Advanced OSINT practice starts when several plausible observations point in different directions. The task is not to invent the most dramatic explanation. It is to identify which records are independent, what their timestamps mean and what a proposed conclusion would require.
Five progressively harder investigations
Operation Archive Patch: Digitized-document provenance and text verification
Use the image, transcription and interpretation as separate layers. Verify pivotal characters against the page before computing a discrepancy; modern file metadata should not be mistaken for the age of the underlying record.
A fictional public archive publishes a machine transcript of a historical invoice. Modern digitization metadata and original-page content must be separated. The supplied scan description is authoritative for the exercise.
Investigate the advanced dossier
Operation Calendar Crossing: Calendar systems and temporal normalization
Normalize calendar, timezone and midnight roll over explicitly before comparing archival dates. A resolved contradiction is not positive proof of every other property of the document.
Two fictional historical offices report different dates for the same dispatch. Use the stipulated calendar offset and local clock conventions rather than assuming a forgery. This is a closed arithmetic exercise.
Investigate the advanced dossier
Operation Provenance Ladder: Historical-object chain and copied-source dependence
Trace ownership claims through actual transfers rather than object resemblance or generated narratives. State undocumented intervals and the provenance of each source; avoid letting a modern summary invent continuity.
A fictional museum acquisition dossier claims continuous ownership. Compare inventories, sale records and a missing transfer. The aim is provenance quality, not identifying or trafficking real objects.
Investigate the advanced dossier
Operation Map Erasure: Cartographic revision and jurisdictional restraint
Keep survey, revision, edition and reproduction dates separate. Compare the correct temporal layers and do not turn a historical map into a current legal or geopolitical conclusion without the governing records.
Fictional maps disagree about an old district boundary. Separate edition date, survey date and redrawn illustration before calling one a falsification. No current territorial claim is made.
Investigate the expert dossier
Operation Station Carbon: Message genealogy and lost context
De duplicate archival copies by original serial and distinguish message issuance, receipt and execution. Search for rescinded or amended instructions before judging whether a later act followed the complete record.
A synthetic 1930 s telegram appears in four archives with different time stamps. Determine independent originating messages and reconstruct the omitted cancellation. Times are normalized using supplied clock offsets.
Investigate the expert dossier
A reusable evidence worksheet
- Record the observation. Preserve the original wording, identifier, timestamp, source and uncertainty. A quoted claim is not the same as an independently verified event.
- Normalize without overwriting. Add a corrected time or comparable amount beside the original. Write the timezone, clock error, unit conversion and rounding rule so another analyst can reproduce it.
- Trace dependency. Identify copied reports, shared instruments and derived records. Several displays may still represent one originating observation.
- Test the competing explanation. Look for a control, alternative version, ordinary mechanism or missing authority that could produce the same visible result.
- State the boundary. Separate established observations, reasonable inferences and unresolved questions. Name the additional independent record most likely to change the assessment.
How these cases level up your practice
Each dossier contains eight synthetic evidence records and seven graded objectives. The first three investigations in this category are Advanced; the final two are Expert. Difficulty comes from multi-record reconciliation and calculation rather than hidden internet searches or obscure trivia. The brief states the necessary assumptions and answer format. You can keep a narrative analysis in your notes while the engine checks the decisive short answers.
Hints are progressive. Start with the structure hint, use the method hint if you need a way into the problem, and reserve the worked-resolution hint for learning after a genuine attempt. Final-answer reveals are a learning review and do not establish an unassisted investigation result. Published methods here explain the approach without reproducing the seven graded answers.
Frequently asked questions
Are these real incidents?
No. The records, identities, organisations and events are fictional. Where public current guidance is linked, it supplies a topic context rather than authentication of a dossier.
Do I need to contact or scan a real target?
No. The supplied packet contains the evidence needed for the objectives. Do not identify private people, access restricted systems or treat a tabletop route decision as real emergency guidance.
Can an unresolved conclusion be correct?
Yes. A sound investigation can establish a discrepancy while leaving identity, intent or cause unresolved. Report the supported result and the evidence required to go further.