Lance The PI

25-Year Licensed California Private Investigator — CA PI License #27617

Full OSINT Guide - Investigator's Edition

By Lance Casey — Licensed California Private Investigator — CA PI #27617 — Updated Mar 2026

This is a collection of OSINT tools, methods, and resources I have built up over 25+ years of licensed investigative work in California. Unlike most OSINT guides written by hobbyists, everything here is based on real casework — surveillance, skip tracing, child custody, infidelity, process serving, and database investigations. Learn the methods. The tools change. The methods do not.

// Table of Contents

  1. What is OSINT?
  2. Search Operators & Google Dorking
  3. People Search
  4. Criminal Records
  5. Business Investigations
  6. Website & Domain OSINT
  7. Phone Number Lookup
  8. License Plates & Vehicle OSINT
  9. Social Media OSINT
  10. Images & Reverse Image Search
  11. Physical Locations & Satellite
  12. Address Lookup
  13. Email Lookup
  14. Social Security Number Search
  15. Skip Tracing
  16. Real Estate Records
  17. Public Records & Court Documents
  18. OSINT Frameworks & Tools
  19. Follow Lance The PI
  20. About the Author

// What is OSINT?

Open Source Intelligence (OSINT) is the collection and analysis of data gathered from publicly available sources to produce actionable intelligence. As a licensed private investigator, OSINT is the foundation of almost every investigation I run before any fieldwork begins. It is legal, it is powerful, and when done correctly it gives you a roadmap before you ever leave your desk.

OSINT is used by law enforcement, private investigators, attorneys, journalists, corporate security teams, and researchers. The key difference between a professional investigator and an amateur is knowing which sources are legally permissible, how to verify information across multiple sources, and how to document findings for use in court.

Licensed PIs operate under DPPA (Driver's Privacy Protection Act) and state PI licensing laws. Always confirm your permissible purpose before running any lookup. If you need a licensed investigator to run searches on your behalf, visit Lance Casey & Associates.

// Search Operators & Google Dorking

Before touching any paid database, exhaust free search engine resources. Google search operators let you filter results with surgical precision. Here are the ones I use most in active investigations:

Additional tools for advanced dorking:

People search is the backbone of skip tracing and subject location work. I run a professional people search service for clients who need verified results with legal permissible purpose. For a deeper breakdown of methods see my People Search guide.

Free and low-cost people search tools:

// Criminal Records

Criminal record checks are a standard part of background investigations, custody cases, and subject vetting. Here are the public sources I start with before pulling paid database reports:

For California-specific criminal records, the DOJ operates the California Law Enforcement Telecommunications System (CLETS), which is only accessible to licensed investigators and law enforcement with proper permissible purpose.

// Business Investigations

When investigating a business, start with public filings before moving to people connected to the entity. Corporate records reveal directors, registered agents, filing history, and sometimes home addresses used during formation.

Always check the Secretary of State website for the state the business is registered in. California business entities can be searched at businesssearch.sos.ca.gov.

// Website & Domain OSINT

When a subject operates a website or online business, domain records can reveal registration details, hosting providers, connected domains, and historical ownership — often linking back to real identities.

// Phone Number Lookup

Reverse phone lookups are one of the most common requests I handle. I offer a professional reverse phone lookup service with access to carrier-level data not available in free tools. For a full breakdown of methods see my Reverse Phone Lookup guide.

Free tools to start with:

If Google searches with the number do not return results, try variations: with and without hyphens, with area code, spelled out. Even a phone emoji in a Google search can sometimes surface social posts containing the number.

// License Plates & Vehicle OSINT

License plate lookups are one of the most powerful tools in a PI's arsenal — and one of the most legally regulated. Under the DPPA (Driver's Privacy Protection Act), plate owner information can only be accessed by licensed investigators, law enforcement, and other parties with a permissible purpose. I operate a professional license plate lookup service and a license plate owner lookup API for businesses and developers who need DPPA-compliant plate data at scale. For state-specific plate information see license plate information by state. For a deeper breakdown see my License Plate Lookup guide.

Running a plate without permissible purpose is a federal violation under the DPPA. If you need plate owner data legally, use a licensed PI. Contact Lance Casey & Associates for DPPA-compliant lookups.

// Social Media OSINT

Social media is a goldmine for investigators. People post locations, relationships, schedules, vehicles, and associates without realizing it. I cover social media OSINT extensively in my work — from child custody cases to infidelity investigations. The key is knowing what to look for and how to preserve what you find.

// Twitter / X

// Facebook

// Instagram

// YouTube

// Reddit

// LinkedIn

// TikTok

// Snapchat

// Username Search

If you have a username, check it across all platforms to find connected accounts:

// Images & Reverse Image Search

If all you have is a photo, extract everything you can from it. Is there a vehicle in the background? A street sign? A license plate? A business logo? EXIF metadata can reveal the exact GPS coordinates where a photo was taken.

Always run photos through at least two reverse image search engines. Yandex is particularly strong for facial recognition on public photos where Google falls short.

// Physical Locations & Satellite

Satellite imagery and mapping tools let you pre-scout a location before physical surveillance. I use these tools on every surveillance job to identify entry points, parking, sight lines, and escape routes before I arrive.

// Address Lookup

Reverse address lookups identify current and past residents at a given address, associated phone numbers, and neighboring properties. I offer a professional reverse address lookup service for clients who need verified results. For a full breakdown see my Reverse Address Lookup guide.

// Email Lookup

An email address can unlock a subject's entire digital footprint — social accounts, forum posts, data breach records, and registered domains. I offer a professional reverse email search service for verified results. For a full breakdown see my Reverse Email Lookup guide.

SSN searches are among the most sensitive and legally restricted lookups in investigative work. Access to SSN data requires strict permissible purpose under federal law. I offer a professional SSN search service for licensed permissible use cases including attorney-retained investigations, court proceedings, and skip tracing. For a full breakdown see my Social Security Number Search guide.

SSN data is restricted under federal law. Only licensed investigators, attorneys, and other authorized parties with documented permissible purpose may legally access SSN records. Never attempt to obtain SSN data without proper authorization. Contact Lance Casey & Associates for legally compliant SSN searches.

// Skip Tracing

Skip tracing is the process of locating a person who has deliberately gone off the grid — avoiding debt collectors, process servers, or legal proceedings. As a licensed PI with 25+ years of experience, skip tracing is one of my core services. It combines database lookups, social media OSINT, phone records, utility records, and field surveillance into a systematic locate operation.

Key skip tracing starting points:

Need a subject located? Contact Lance Casey & Associates for professional skip tracing services.

// Real Estate Records

Property records are public and reveal ownership, purchase price, mortgage holder, mailing address, and tax records. These are invaluable for locating subjects and identifying assets in civil litigation support work.

// Public Records & Court Documents

Court records are one of the richest sources of verified personal information available to investigators. Filings contain addresses, employer information, financial disclosures, and sworn statements.

// OSINT Frameworks & Tools

These are the master reference tools and frameworks used by professional investigators and security researchers. Start here when you are not sure where to look next.

// Reverse PO Box Lookup

PO Boxes are commonly used by subjects trying to conceal their physical address. A licensed PI can run a reverse PO box search to identify the registered holder and associated physical address on file with USPS. I offer a professional reverse PO box search service. For a full breakdown see my Reverse PO Box Lookup guide.

USPS PO Box registration data is not publicly available. Only licensed investigators with permissible purpose can legally obtain PO Box holder information. Contact Lance Casey & Associates for a compliant PO box lookup.

// Follow Lance The PI

I post real PI content, OSINT tips, surveillance footage, and live Sacramento scanner coverage across multiple platforms. Follow along:

// About the Author

I am Lance Casey — a licensed California Private Investigator with over 25 years of field experience and a former law enforcement background. CA PI License #27617. I operate Lance Casey & Associates in Sacramento, California specializing in surveillance, skip tracing, license plate lookups, process serving, and OSINT investigations. I have testified in court over 100 times and hold a criminal justice degree.

Online I go by Lance The PI — creating content across TikTok, YouTube, Instagram, and Facebook covering real investigations, PI tips, and live Sacramento scanner coverage generating millions of views monthly.

Need a licensed PI? Visit lancecasey.com or call my Sacramento office.

Affiliate Disclosure: Some links on this page are affiliate links. If you make a purchase through these links I may earn a small commission at no additional cost to you. I only recommend tools and services I have personally evaluated.