Whether you are investigating fraud, harassment or other misconduct, solid online research skills can serve you well. The internet is a valuable resource for finding information and evidence to support your case, and it’s important to stay up to date on its use and limitations. Join Cynthia Hetherington, investigation expert, trainer and founder of Hetherington Group, as she explores techniques and tools for getting the information you need online.

1. Search Engine Skills
for Workplace Investigators
Cynthia Hetherington, MLS, MSM,
CFE, CII
Founder, Hetherington Group

2. Cynthia’s Expertise
• OSMOSIS Institute Founder
• ACFE Faculty
• ASIS Educator
• Global OSINT presenter
• Author & publisher
• Analyst
• Security Practitioner
• Investigator
• Tech
• Librarian

3. Overview
The ability to uncover information on the Internet is the primary skill of an
online investigator.The go-to resource for many is Google, yet not everyone
knows how to utilize its full potential.
In this intermediate to advanced hands-on class, participants will learn how
to maximize Google searches, as we cover the basics, the hacks, and extra
Google resources to create proper search strategies and run advanced
Internet searches. Participants will also learn the expert tools of this
common search application to make difficult searches more effective.

4. Google Primer to Results
• Google remains most popular compared to alternative search engines
• Google has the largest arsenal of results
• Google has the fastest return on their results
• Google ranks results by popularity
o Social media sites
o Sale sites
o Promoted sites

5. Google Search Results
LinkedIn
Facebook
Twitter

6. Bottom of the List
The real number
Wow results
Wow results

7. Search Engines 1.0
• Search engines default to lower case capitalization.
o Don’t worry about the Cynthia or iOS or NewYork
o This works cynthia or ios or newYork
• . ? !@$ – all standard marks are ignored
• Some symbols between words.
o AND is represented with a “+”
o NOT is represented with a “-”
o The underscore symbol _ is not ignored when it connects two words,
such as “quick_sort”

8. SEO and Punctuation

9. Google Operators
Operator Definition Example
“ “ The exact phrase “can I get a witness”
AND Results for one search
term and another
dog and food
OR (same as pipe I) Results for one search
term or another
vegetarian or vegan
.. range of something $5..$50 or 2010..2020
- Exclusion shoot-photo
* Wildcard proximity
searching
Cynthia * Hetherington
# hashtags for topics #osint

10. Google Operators
Operator Definition Example
() Grouping search operators (cynthia OR president)
“hetherington group”
filetype: Specific file types filetype:pdf “highly
confidential”
site: Specific website site:sec.gov
cache: Search cached version of a
website
cache:hetheringtongroup.c
om
inurl: Narrows to terms in URL inurl:abctrucking
link: Linking to a specific URL link:hetheringtongroup.co
m
source: and location: Google news narrow to
source or location
source:usatoday.com or
seattle:protest

11. Address searches
• “123 highland avenue wanaque new jersey” too much
• “123 highland avenue” Wanaque
o technically asking Google to show exact matches for avenue not ave
• “123 highland ave” Wanaque
o ideal search that will provide results for both ave and avenue
• “123 highland”Wanaque
o can try leaving out street altogether
• “123 w highland ave”
o not the same as “123 west highland ave”
• “123 w highland” Hetherington
o person/company and address search

12. Searching phone numbers
• 909-450-7405 = “909 450 7405”
• No dashes, parenthesis, backslashes, etc.
• Just spaces
• Scrutinize the results

13. Google Asterisk
Common Names Found
• Carlos Gonzalez
• Mohammed Abdullah
• Michael Smith
• Vihaan Patel
• Sara Moore
• Fathima Mohamed
• Roberto Edwardo Rodriquez

14. Google proximity searching
• NewYork within 15 words ofYankees
o new york * yankees
• “Carlos Gonzalez” within 15 words of “Camden Police”
o “Carlos Gonzalez” * “Camden Police”
• Carlos Juan Gonzalez or Carlos J Gonzalez
o “Carlos * Gonzalez”
• Missing word “I * the ABC Company”
• Email addresses based on known usernames “username * com”

15. Google site searches
• Site searching social media
o site:facebook.com ch@hetheringtongroup.com
o site:facebook.com “973 706 7525”
o site:twitter.com @osmosiscon
o site:reddit.com intitle:disney
• Site searching to go beyond what is searchable through website search bars
o site:sec.gov “abc company” china
• Site searching for people or specific text on a website
o site:sidleylaw.com smith
• Sometimes a simple hack to website that require subscription

16. Google.com/alerts
Make sure you choose
Automatic & All results

17. Google Alert = yingyang
• News
• Images
• Blogs – badly
• Books
• Video
• Finance
• Discussion - Dark web

18. More useful website searches
• Find changed or deleted content with
cache search
o cache:osmosiscon.com
• Find related websites
o related:osmosiscon.com
• Get details about a website before
even visiting that site
o info:osmosiscon.com
• Website not active or want to see
where else the website is mentioned?
o “osmosiscon.com”

19. Google file type searches
• Using standard file types, you can narrow down your search to key
company information (.pdf, .doc, .xls, .ppt, .txt, .jpg)
• Filetype:pptx–One word and no space between!
o Also ext:pptx
• Add words like “attorney work product” or confidential
• Find county and state documents
• Find company, organization, or event brochures, reports, presentations
not accessible through their website
• Find donor information for nonprofits, annual reports often released as
PDFs

20. More on cache content
• Cache version of page can be accessed by clicking the green arrow next to
the URL
• Will take you to the version of the page the search engine saw when it last
visited the site, the indexed content.The date will be still be stamped.
• Tip, deleted social media content may still be cached from the source
directly, or a third party.
• How to remove outdated cache? Must be signed into Google account. New
Link as of January 2021: https://search.google.com/search-
console/remove-outdated-content

21. Spam and phishing attempts
• Search on the content of the email to check and see if it’s been stolen from
another site, a legitimate site, or similar.

22. Google Timeline
• Use tools to change timeline of results to past hour, 24 hours, week, month,
year, or custom range
• Does not necessarily mean that that was the date the content was posted

23. Google country searches
• Can change within settings, use country codes (google.ca) or no country
redirect (google.com/ncr)
• Searches need to make sense. Check out Sayari knowledge center for tips on
name searches in other countries. https://knowledge.sayari.com/hc/en-us

24. Don’t want a country bias
• Use .ncr as an extension for no country redirection
o Google.com/ncr
• Just because you add .ca doesn’t mean your browser is magically in Canada.
• NCR stands for "no country redirect", and visiting that link sets a cookie that
will prevent redirects in the future.
• As long as the cookie is set, you will get the global site and results.
• If you want to get regional results, click on "Go to Google %country%" at the
bottom right corner of the screen.

25. @User Search
• Search social media
o Put @ in front of a word to search
social media.
o Example: @hetheringtongrp
• If the handle is used as a nickname on the
site it will appear in your results.
• If the handle is used on a Google indexed
page it will appear in your results.

26. #Topic Search
• Search hashtags
o Put # in front of a word or topic.
o Example: #OSMOSIS19

27. Social media searches without account
• Knowing URL format, you can search for indexed content through Google on
many social network platforms without needing an account

28. Google Advanced Search

29. End Notes
• Google has so much more than “I’m feeling lucky” button
• Take the time to learn the unique aspects of this powerful tool
• Results can be narrowed by
o Media
o Date
o Topic
• Yet, google doesn’t search for content within blogs

30. T h a n k Y o u f o r
P a r t i c i p a t i n g
Find more free webinars:
www.i-sight.com/resources/webinars
@ i s i g h t s o f t w a r e
C o n t a c t
C y n t h i a H e t h e r i n g t o n ,
M L S , M S M , C F E , C I I
C o n t a c t
i - S i g h t
We b i n a r s @ i - s i g h t . c o m
c h @ h e t h e r i n g t o n g r o u p . c o m
c y n t h i a h e t h e r i n g t o n
@ h e t h e r i n g t o n g r p
w w w. h e t h e r i n g t o n g r o u p . c o m