# OSINT Evidence Log — Worksheet

From "Keeping an OSINT Evidence Log", SPURIA Field Notes:
https://blog.spuria.app/writeups/osint-evidence-log/

**Investigation:** ______________________________________________

**Question under test:** ______________________________________________

**Analyst:** __________________  **Started (UTC):** __________________

**Clock NTP-synced?** yes / no  **Hash algorithm:** SHA-256

---

## Rules

1. Capture, hash and archive a source **before** you analyse it.
2. The log is append-only. Once written, `observation`, `inference` and `confidence` are frozen.
   Only `status` and `refs` may change, and every status change gets its own entry saying why.
3. Observation and inference go in separate fields. If you can't name a falsifier, the
   inference isn't testable yet.
4. Log dead ends (one sentence) and failed archive attempts. They are information.
5. A report sentence cites entry IDs and is never more confident than the weakest entry it
   depends on.

## Fields

| Field | Fill in |
|---|---|
| `id` | `E-001`, `E-002` … Sequential, never reused. Name saved files by it. |
| `captured_utc` | Capture time, `YYYY-MM-DDTHH:MM:SSZ` (`date -u +%Y-%m-%dT%H:%M:%SZ`). For an entry with no capture, the time it was written. |
| `source_url` | The exact URL of the item, not the site. |
| `archive_url` | Wayback Machine / archive.today snapshot URL, opened and checked. Or `failed: reason`. |
| `local_file` | Your saved copy: the file as served, not a screenshot of it. |
| `sha256` | `sha256sum FILE`. Append to `hashes.sha256`; verify with `sha256sum -c hashes.sha256`. |
| `observation` | What is literally in the source. No interpretation. |
| `inference` | What you conclude and why. |
| `confidence` | **high**: two independent sources agree, or one primary source leaves no alternative. **medium**: one source, or several that could share an origin. **low**: plausible, untested. Add a one-line reason. |
| `falsifier` | The concrete observation that would prove the inference wrong. |
| `status` | `captured` · `open` · `supported` · `dead-end` · `retracted` |
| `next_action` | The exact query, tool or check you run next. |
| `refs` | IDs this entry depends on, derives from, or supersedes. |

## Capture commands

```bash
ID=E-001; URL='https://…'
date -u +%Y-%m-%dT%H:%M:%SZ
curl -sS -D "${ID}_headers.txt" -o "${ID}_page.html" "$URL"
sha256sum "${ID}"_* >> hashes.sha256
curl -s "https://archive.org/wayback/available?url=$URL"
# then submit to https://web.archive.org/save and https://archive.today, check both snapshots
```

---

## Entry sheet (copy per entry)

```
ID: ________   Captured (UTC): ____-__-__T__:__:__Z   Status: ____________

Source URL:   ____________________________________________________________
Archive URL:  ____________________________________________________________
Local file:   ______________________   SHA-256: ______________________________

Observation:  ____________________________________________________________
              ____________________________________________________________
Inference:    ____________________________________________________________
              ____________________________________________________________
Confidence:   low / medium / high   because ___________________________________
Falsifier:    ____________________________________________________________
Next action:  ____________________________________________________________
Refs:         ____________________________________________________________
```

---

## Example (fictional)

Everything below is invented: Vessenby, its shops, its council, the accounts and every URL.
`.example` domains are reserved for documentation (RFC 2606) and don't resolve. Hashes are
placeholders.

**Question:** Does a photo posted on 3 March 2026 at 09:02 UTC show the Old Mill footbridge in
Vessenby, taken that day?

**E-001** · 2026-03-03T09:31:12Z · status: captured
- Source: `https://social.example/p/88412`
- Archive: Wayback `https://web.archive.org/web/20260303093305/https://social.example/p/88412` (checked). archive.today: failed, login wall.
- Files: `E-001_page.html`, `E-001_photo.jpg` (`48a9b525…aeec2384`)
- Observation: post at 09:02 UTC, caption "Old Mill footbridge in Vessenby going under right now", one JPEG 1600×1200.
- Inference: none yet. Claim under test, preserved.
- Next: exiftool; reverse image search.

**E-003** · 2026-03-03T09:58:40Z · status: ~~open~~ **retracted** (see E-005)
- Source: `https://news.example/vessenby-flood-november-2019`
- Observation: reverse image search returns a 14 Nov 2019 article, "Vessenby flood", with a photo of the same footbridge from nearly the same spot, water at deck level.
- Inference: the viral photo is recycled from 2019.
- Confidence: medium. Near-identical at thumbnail size, not compared in detail.
- Falsifier: any fixed detail that differs between the photos, or that postdates Nov 2019.
- Next: compare at full resolution, side by side.

**E-005** · 2026-03-03T10:12:50Z · status: supported · refs: E-003, E-004
- Observation: E-004 found three fixed differences: railings grey (2019) vs green; fascia `VESSENBY CYCLES` vs `PELLOW & DAUGHTERS · HARDWARE`; church tower left vs right of a lamp post.
- Inference: E-003 is wrong. It took "same place" for "same photo". What survives: the 2019 article places the bridge in Vessenby, independent of Account A.
- Confidence: high. Three independent fixed details.
- Action: E-003 set to retracted. Entries depending on E-003: none. Next: date the railing colour.