Welcome to edition 12 of OSINT Field Notes. It’s an honour to bring you these newsletters and practical skills each month and receive the really helpful and supportive feedback from those of you that read it and find it useful.
I’m making this month’s edition of OSINT Field Notes a thematic piece, looking at how open source investigative techniques, data analysis and clever sleuthing can help response efforts to disasters, in light of the horrific events in Nepal.
With disasters like this, things move fast online and offline and what’s critical is getting the truth from the ground. This is especially the case in environments where restrictions and disinformation impede access to the reality on the ground.
Emergency response efforts coordinate information on locations, supply routes and access to data to support that. At the same time, online efforts to locate lost family members, reconstruct events for news, and battle the scourge of disaster-related fake news, all use these same skills in one way or another.
And that’s what this edition is about: disaster data. We’ll look at how to find rapidly available imagery released during disaster efforts, how to verify what a viral video actually shows, constructing a visual timeline of events and even the geolocation of the last known whereabouts of missing family.
To make sure these newsletters are efficient, I’m changing the order of content to prioritise the practical parts such as the technical teardown where we walk through how to do things, and the case file where we walk through a case and the methods and techniques. The dispatches and toolkit will be at the bottom of this edition.
So let’s get into it. Ben.
1. Technical Teardown: how to find free satellite imagery from commercial providers during disasters
Some commercial satellite imagery providers make their high-resolution imagery free to support response efforts to disaster events.
If you are trying to understand what happened on the ground, or geolocating footage of the aftermath, this type of rapidly updated imagery can be incredibly helpful.
In the aftermath of the Nepal floods, Vantor published an open collection of imagery, as part of its Open Data Program.
The imagery can be accessed from a number of places including on Vantor itself, but two multi-source locations I used for the Nepal floods were MoreGeo or Development Seed.
Each of those, as seen in the images above, give a map-style interaction to load the available satellite imagery.
Start with a question
When you’re looking for updated imagery of disasters, don’t just scan through the library of available images looking for the most dramatic one.
One thing I do is pick one set of images that have a before and after (or you can opt to use a before from other freely available imagery resources), and have a series of questions to think of.
For example, questions you might have when looking at imagery might be:
Did the visible river change near any settlements?
Are critical roads still connected?
Are there any changes to buildings within settlements?
Read the imagery metadata before looking at the visuals
Things to keep in mind when scrolling through these libraries of satellite imagery are to check the footprint, acquisition time, cloud cover and viewing angle. Knowing those things only takes a quick minute and can help decide whether the image is going to be worth loading and scrolling through.
For example, a recent Vantor item I checked, B120001101226410, reported 94% cloud cover and an off-nadir angle of about 44 degrees. It was recent and it covered the area, but much of the scene was hidden.
In many cases, recent imagery doesn’t always mean useful. However, that image was easy to check, because it also meant there was a very small area visible in the image, so it didn’t take me too much time to check that out.
Open the actual image
In moreGeo, for each item you see on the map, you can download it or copy the source URL by clicking on the specific satellite tile, or scrolling down the viewable list, and finding those download options under Asset > Visual COG.
For a quick assessment, show it on the map first. Development Seed offers the same basic route through the item properties and asset links.
Record the title number or item ID and acquisition time (often referred to as datetime) as soon as you choose a scene and start looking at it, so that you know when the change was observed and on what item.
Do note that publication time and capture time are different things, and the capture time is the one that belongs on your comparison.
Build a comparison, not a collage
Find an overlapping image from before the flood. Match the location and scale, then check whether the older image is recent enough for the question. This collection includes historical imagery, so a difference may reflect years of construction, seasonal river change or an earlier disaster rather than the flood you are investigating.
I find when doing imagery analysis like this, that it’s helpful to keep a small analysis log, kind of like a little journal as to what you’ve seen, where you saw it, the details of the image, dates etc. I usually set these up in a spreadsheet covering:
A link to where you got the imagery from
coordinates of the change you witnessed
pre-event item ID and acquisition time
post-event item ID and acquisition time
cloud or angle limitations
what visibly changed
I put ‘visibly’ in bold, because that’s important for this work. If your conclusion is “the road connection is no longer visible in the post-event image”, write that. Do not jump to the conclusion that “the flood destroyed the road” unless an image can visually confirm that.
Diversify the imagery
The Vantor assets I inspected were one type of imagery, but there’s many out there and a number of commercial providers also support open data programs during disasters.
A helpful tool that has been developed to explore different imagery is this Nepal Floods Imagery Viewer which has compiled a number of different providers into a single resource. The benefit of this is there are different spectral features for those different images, for example the Pelican imagery from Planet seen on the viewer can be selected to view false colour or NDWI.
I also mention diversify imagery, because in some disaster efforts there are also releases of drone imagery (see the clarity in the imagery below), which can be incredibly useful for geolocation and further analysis.
2. Case File: one video, two sources, one false story
A widely shared video was seen on X more than 1.8 million times, claiming to show an F-16 bombing a dam and causing the floods in Nepal.
The video was actually two videos. One was an AI-generated video showing an explosion in a dam wall. The second video was real and shows CCTV footage from the Gyirong border area during the flood. In this case, the claim was incorrect.
The claim and the footage was fact-checked by Lead Stories, who found that the AI-generated video had in fact been circulating online since at least 10 May, 2026.
This work is critical, and in many cases, just like this Nepal floods-related fake news, much of the leg work was done through a quick image-reverse search.
We can follow those steps, by selecting key frames from the video and making screenshots.
When we do an image reverse search using Google Lens, we can see just how many times this AI video has been repurposed for the Nepal context, or others. It’s also not the only video to go viral of a jet bombing a dam. Another fake video, showed in the recommendations, was viewed more than 5 million times.
By looking at the source and uncropped footage on Facebook, it is clear that this was AI-generated imagery due to the label (see the little white ‘Ai’ in the top left). However we would also be able to identify that this was AI-generated footage by analysing the jet, how it flew, the area and verification of the dam.
In general, when it comes to these cases, I find the most useful question is not “is this video real?” It is:
Which parts of the video are real?
When was the video, or parts of it, originally posted?
Does the claim being made in the comments or text uploaded with the video actually match the footage?
What can we prove with our findings through referencing links and analysis, as opposed to just saying “this is fake”?
3. Dispatches from the disaster response
Reuters
This coverage from the Reuters Graphics team shows a reconstruction of the rapid landslide and flood and how it came from the glacier source down through the valley using satellite imagery, terrain data and verified footage.
There’s a good building of trust right at the top in this report, because it clearly states what is known vs what isn’t known. That’s good analysis, because not every explainer needs to know every detail, and in a sea of mis/disinformation, sometimes it’s critical to get facts out early, even if it means the entire picture isn’t completely known.
The sources used to visualise this report are the method, and can be applied to many other contexts. They’ve effectively stacked sources to be able to tell the story, using tools often featured in this newsletter, such as: Sentinel-2 imagery, Google Earth, geolocated footage and open data (as covered above) from Vantor, Planet, Open Street Map.
OpenStreetMap / HOT
In response to the disaster, Humanitarian OpenStreetMap Team (HOT) and NAXA launched a mapping initiative, in collaboration with the local mapping community, to support ongoing humanitarian efforts in the region. The OSM team launched a public map to show the extents of Tasking Manager projects (red) and the boundary of the focus area (blue).
This response shows what happens after imagery becomes available: roads, buildings and affected areas are turned into helpful geographic data to support ongoing efforts.
Similar to the technical teardown, you can access the tasked imagery through the OSM Nepal Floods panel.
Reddit: locating a missing person’s last image
A user posted to r/whereisthis after a friend's father went missing around the Nepal–Tibet border. The photograph they shared was the last image he had posted to social media. There was no location attached, so they asked whether anyone could work out where it had been taken.
Within the thread, Redditors matched the building to the Integrated Customs Building at Rasuwagadhi. One of the replies specifically points to the windows as part of the match, while another contributor says they recognised the location from Google Maps. The person who posted the appeal then confirmed that he regularly worked there.
It is a very simple technique of visual geolocation, but the application is important. Open source work did not determine what happened to the missing man. It did, however, turn an unidentified photograph into a specific place and therefore help establish where his last known visible location might have been.
A lot of geolocation exercises online are treated almost like puzzles, but this case is a reminder of how those exact same techniques can be used in the real world to find the last known location of someone who is missing after a disaster.
4. Toolkit
Copernicus Emergency Mapping: the ESA, Copernicus Emergency Mapping service provides a resource in times of disasters for monitoring and response efforts. This specific one, in response to the flash floods and landslide in Nepal, provides a rapid flood extent and damage assessment mapping, which is publicly available.
Google Fact Check Tool: I’ve mentioned this tool in the past, but the recent floods and wave of mis/disinformation is a timely reminder of the Google Fact Check tool, which indexes fact-checks done by local and international outlets and categorises them in different ways, depending on country, theme or event. I wanted to include this tool because I think it’s an incredible place to kick off more detailed investigations into patterns of networks, coordinated activity and digging into who is behind specific networks.
A small personal update
I have been in the process of working on an affordable, self-paced course on open-source investigations and analysis. I’m truly excited to share this, as it’s been a work in progress over some time, especially after the success of the YouTube series I ran called “OSINT At Home” and the trainings I’ve delivered around the world, many of which focussed on entry level techniques and using them in real-world investigations.
The course I am designing is going to focus on practical work and lessons I’ve learned leading investigations in the field. It’s going to be full of very real-world exercises and technique-driven, covering many of the topics I’d wish I had available when I was first starting out as an investigator. Stay tuned, as it will be ready in the coming months.
Closing Note
If writing this edition of OSINT Field Notes has reminded me of anything, it is just how vast the applications are for open source investigative techniques.
In this edition we looked at how the geospatial data community pulled together to coordinate mapping of buildings, serve up imagery, stack geospatial data with other forms of open source data to support humanitarian efforts.
We’ve seen fact-checkers debunk viral claims attempting to attribute blame of a natural disaster and disinform people who are desperate to get news about what’s happened in Nepal.
And we saw how online communities helped locate the last known photo of a missing person.
Same techniques, different subjects. All with the aim to add valuable, trustworthy, information to an environment susceptible to incorrect information.
If anything, I hope this edition on disaster data inspires you to think about different applications of the skills you’ve learned from this newsletter, even if it’s just an image reverse search, because many a great investigation stem from just that.
Ben.