Case log
Record each capture with a UTC timestamp and a hash of the saved file. Entries stay in this browser only. Export to CSV or JSON at the end of each session and attach it to your case file.
| UTC | Case / officer | URL | Description | Hash |
|---|
Try
- TLocal tool
- DDork
- RFree login
- LLE / gov only
- FFree for police
- newAdded Sept 2026
- AMay alert subject
- PPrivacy / legal
Runs in your browser · nothing is uploaded
Toolbox & case log
File hash
MD5, SHA-1 and SHA-256 for evidence files, or to search a hash in VirusTotal without uploading the file.
Choose one or more files.
EXIF viewer
Reads camera, date and GPS metadata from a photo inside your browser. The file is never uploaded.
Choose a JPEG, HEIC, TIFF or PNG file.
Container, IMO, VIN & IBAN validators
Check digits catch typos and fabricated numbers on manifests, bills of lading and payment documents.
Phone number & IMEI analyser
Country, number type and every format the number may appear in online. Also checks IMEI check digits.
Coordinate converter
Paste decimal or degrees-minutes-seconds coordinates, e.g. from EXIF data or a screenshot, and open the spot on every map.
Crypto address identifier
Identifies the blockchain from the address format and links to the right explorer.
Username & email permutations
Generates the handle and email patterns people most often use, ready to paste into WhatsMyName, Holehe or a breach search.
Dork builder
Builds advanced search operators and runs the query on four engines.
Time & snowflake IDs
Converts Unix, millisecond, Windows FILETIME and ISO timestamps across time zones. Decodes the creation time hidden in X / Twitter and Discord IDs.
Encode / decode
Base64, URL, hex, ROT13 and URL defanging for safe reporting. For anything more complex use CyberChef.
Suspect profile · saved in this browser
Build a profile from what you know
About this framework
A directory of open-source intelligence resources organised for law enforcement investigators, organised by line of enquiry rather than as one alphabetical tree. Besides the classic OSINT categories it adds categories for maritime and container intelligence, customs and trade, drugs, sanctions, wanted persons, financial crime, platform law-enforcement portals, legal frameworks and international cooperation.
How to use it
- Type or paste a selector in the search bar. The type (email, container number, wallet…) is detected automatically; click the type chip to change it.
- A run sheet appears: every source that accepts that selector, already filled in, grouped by line of enquiry. Opening a search ticks it off; the progress bar shows what is left.
- Click Log next to a search to add it to the case log with a UTC timestamp. Export the log from the Toolbox.
- With the search bar empty, the left rail lets you browse all sources by line of enquiry.
Flags
- T Tool you install or run locally.
- D Google dork: a pre-built search query.
- R Registration or login required.
- L Only for law-enforcement or government accounts.
- A Active: the subject may be alerted, or the platform logs your visit against your account (for example LinkedIn profile views).
- P Privacy or legal caution: facial recognition, or uploads that become visible to other users.
- F Free for verified law enforcement (you apply with your official email or ID).
- new Added or updated in the September 2026 review.
Operational security
- Work from an approved, non-attributable research environment. Never use personal accounts.
- Search a file's hash before you upload the file anywhere. Public sandboxes share uploads.
- Do not paste case material into public translation or AI services unless your agency has approved them.
- Collect only what is necessary and proportionate. Your authority, not the tool's availability, decides what you may do.
Privacy of this page
This page makes no network requests with your selector. Searches go directly from your browser to the site you click. The Toolbox runs entirely in your browser; the case log is kept in this browser's local storage until you clear it.
Disclaimer
Listed sites are third-party services, not endorsed. Links are checked automatically each week, but sites change. Verify every finding against a second source before relying on it.