Thread by @henkvaness

The next few tweets are about one of the suspects of the attack of @PeterRdeV. I will not mention the suspect's full name, and I am not implying that the person tried to kill him. Let's start with how to find the full picture of the Polish suspect. (1/...) theguardian.com/world/2021/jul…

For that, you need to find a cell phone number first. I found that number in the database of a local chamber of commerce. Now how do you get the full picture of the person behind that number? (2/...)

The suspect from Poland uses his number in Whats App. It's maybe the person in the middle (blurred). Now, this picture is not in the highest resolution. So how do you get the best possible photo? (3/...)

Here is the full picture of the suspect - again, just that, suspect. If you type in any cell phone number into watools.io/download-profi…, you will get a better resolution (4/...)

Now, look at the picture in the last tweet. If you are in for a #osint challenge: what does this photo reveal? Look at all the little details. (5/...)

Of course, I am walking a thin line here: should I show all that is possible, or is it not wise to publish too many details? The person just founded a company, on 04/06/2021, and is the sole owner. Below are some details about what the company does. I use #orbis for this (6/.)

That's why the company has no historical records. It just opened "business", according to kvk.nl (7/..)

Now it's important to not only use public sources but pay for the actual data ($3 in NL) via the Chamber of Commerce of the country you are researching, With that, you get additional data that is not in #orbis or in public sources (8/..)

Birthdate is important for cross-reference, it's in the file (9/..)

The suspect gave a non-existing e-mail address to the authorities. (Don't type icoud.com yourself, it will lead to a spam site). But could it be it's just a typo, did he mean icloud.com? In other words: how can we be sure that it is a typo? (11/....)

For that, I use tools.epieos.com/email.php - it shows you amongst many other things if the e-mail address was ever used. It was. With OPENCNAM we find out that his cell is still active opencnam.com/dashboard/deli… (12/...)

If we study the e-mail address, we learn that the person is probably not using his middle name. This helps to find him easier on social media. Please use at least 7 variations of a name when you research people, as shown here (13/...)

While using the name variations, I get our suspect in new sources I didn't know of yet, like Facebook. What helped is telling Google that I am only interested in the Polish section of Facebook, as shown in this formula. I left out the name. (14/....)

Another tool I used to find more photos of the suspect is pimeyes.com (paid version) I also did some video analysis, explained in the next tweet (15/..)

I downloaded a video of the possible suspect, playing soccer, via Downie (Mac) or try 4kdownloader (Windows) and gave it to videoanalyzer of Azure. Next tweet: does the face recognition work? (16/...)

Sorry all, still waiting, but not THAT long. A 256 Mb video on YouTube takes about 12 minutes to process. (17/...)

Polish is translated into English in 12 minutes (photo 1). It takes time to index heads, see the job I ran in a different case (photo2) I think this is it for today! Hope you agree that I didn't reveal information that can hinder police work! It's all about the method. (18)