[SUBJECT FULL NAME] - Collection Map
OSINT-001 Standard Subject Dossier - collection workspace. Central topic = the subject. Branches = data-point categories. Drop each collected value as a child node; expand it with where it was found. Paste raw tool output into the node’s Notes. → feeds deliverable OSINT-001.
00 · Collection Plan - PIRs & EEIs
The questions this collection must answer + the essential elements of information (EEI) for each. Tick as satisfied. → drives §3 Key Judgments, §4 PIRs, §12 Verified Findings, §16 Gaps.
PIR-1 - Identity: is the subject uniquely resolved?
- EEI: full legal name + DOB/YOB + place of birth
- EEI: corroborating identifiers (address + employer + photo)
- EEI: same-name candidates identified & excluded
PIR-2 - [question]
- EEI:
- EEI:
PIR-3 - [question]
- EEI:
Collection gaps / RFIs (running)
- [open item] → route to [product]
- [open item]
01 · Identity & Biographic
Who the subject is, verified vs. claimed. → feeds §5 Identity Resolution, §6 Biographic.
Names
- Full legal name:
- Middle name / initial:
- Maiden / former name:
- AKA / aliases:
- Transliterations / native script:
Birth & nationality
- DOB / YOB:
- Place of birth:
- Nationality / citizenship(s):
- Government / national ID (partial/redacted):
Physical description
- Description:
- Distinguishing features:
- Languages spoken:
02 · Contact & Selectors
The pivot core. Each value is its own node - expand it with where it appears and what it links to. Clone the sub-block per value.
Phone numbers
→ feeds §5 Identity, §8 Digital Footprint.
- [number - e.g. +1 555-0142]
- Type / carrier: [mobile / landline / VoIP]
- Linked accounts / apps:
- Where found (source + URL):
- Attribution confidence: [Confirmed / Probable / Possible]
- Notes / tool output: ← (caller-ID, truecaller, etc.)
- [number 2]
Email addresses
→ feeds §5 Identity, §8 Digital Footprint, §8 Exposure.
- [email]
- Linked accounts (acct discovery):
- Breach / paste appearances:
- Where found (source + URL):
- Attribution confidence: [Confirmed / Probable / Possible]
- Notes / tool output: ← (holehe, h8mail, hunter.io)
- [email 2]
Usernames / handles
→ feeds §8 Digital Footprint, §5 Identity.
- [handle - e.g. csmith200]
- Platforms / where found (URL):
- Linked email(s):
- Linked phone(s):
- Other accounts reusing it:
- Attribution confidence: [Confirmed / Probable / Possible]
- Notes / tool output: ← (idcrawl, sherlock, whatsmyname)
- [handle 2]
03 · Addresses & Locations
→ feeds §5 Identity, §7 Pattern-of-Life (geographic footprint).
Current address
- [address]
- Dates associated:
- Basis / source:
- Confidence: [H/M/L]
Previous addresses
- [address]
- Dates:
- Source:
Other associated locations
- [location - work / frequented / travel hub]
- Type:
- Basis:
04 · Digital Footprint
→ feeds §8 Digital Footprint, §8 Exposure & Breach Indicators.
Social media accounts
Clone per platform. Attribution is itself a judgment - grade it.
- [platform - Facebook / X / Instagram / LinkedIn / TikTok / other]
- Handle / URL:
- Attribution confidence: [Confirmed / Probable / Possible]
- Status: [Active / Dormant]
- Notes (content / affiliations):
Websites / domains
- [domain]
- Registrant / WHOIS:
- Hosting / IP:
- Notes:
Forums / communities
- [site + handle]:
Breach / paste / data-broker exposure
- [indicator]
- Source:
- Date observed:
- Significance:
05 · Network & Associations
→ feeds §9 Network & Associations. Each link is graded.
Family & household
- [name]
- Relationship:
- Basis / source:
- Confidence: [H/M/L]
Business / professional associates
- [name]
- Relationship:
- Basis:
Social / other
- [name]
- Relationship:
06 · Employment, Education & Affiliations
→ feeds §6 Biographic Profile.
Employment
- [employer]
- Role / title:
- Dates:
- Verified / claimed:
Education
- [institution]
- Credential / dates:
- Verified / claimed:
Licenses / memberships
Military / government / security service
07 · Financial & Lifestyle Indicators
OSINT-visible only - indicator level, not a forensic trace. → feeds §10 Financial & Lifestyle Indicators.
Real property
- [property]
- Basis / record:
- Confidence: [H/M/L]
Corporate / business interests
- [entity]
- Role / stake:
- Registry source:
Vehicles
- [vehicle]
- VIN:
- Make / model:
- Plate:
Public filings / observable lifestyle
- [indicator]:
Financial-stress / adverse indicators
- [lien / judgment / bankruptcy (public)]:
08 · Legal & Derogatory
Distinguish charged vs. convicted vs. alleged; date and grade each. → feeds §11 Legal, Regulatory & Derogatory.
Criminal / court records
- [matter]
- Jurisdiction / case #:
- Status / disposition:
- Source grade:
Civil litigation
- [case]
- Role (plaintiff/defendant):
- Status / summary:
Regulatory / professional actions
Sanctions / PEP / watchlist screening
- OFAC SDN / Consolidated: [Clear / Hit / Near-match]
- EU / UK / UN sanctions:
- PEP databases:
Adverse media
- [outlet + date]
- Substance:
- Reliability (A–F) / Credibility (1–6):
09 · Media & Imagery
→ feeds §8 Digital Footprint, Appendix D Evidence Archive.
Photos of subject
- [image ref]
- Source / URL:
- Metadata (EXIF):
Avatar / profile picture
- [image]
- Reverse-image locations used:
Video
- [file]
- Source / metadata:
Audio
- [file]
- Source / notes:
10 · Pattern of Life
Open-source only - no covert/physical surveillance. → feeds §7 Pattern-of-Life.
Routine & temporal patterns
- [observed cadence]:
Geographic footprint
- [habitual location]:
Travel & mobility
- [observed travel]:
Anomalies / deviations
- [departure from pattern]:
99 · Collection Admin
Working register - not a deliverable section, but the audit trail behind it.
Source register
Every material datum traceable to a graded source.
- [S-1 - source]
- Type: [Primary / Secondary / Tertiary]
- Reliability (A–F) / Credibility (1–6):
- Date accessed:
Evidence archive
- [screenshot / capture ref + hash + URL + timestamp]:
Open gaps / verification pending
- [item submitted, not yet returned]