רשימת פעולות
- 01
Define a testable claim
Write precisely who allegedly did what, where and when. Separate the question from expectations to avoid looking only for confirmation. Separate an organisation from a namesake, subsidiary or account discussing it. Record the identifiers used and unresolved ambiguity. A conclusion should answer a question whose answer could change with new evidence.
- 02
Trace the earliest source
Find the original document or media, its date and publication context. A screenshot or repost does not establish authenticity. Find the complete edition and earliest accessible publication, then check whether it cites an earlier origin. Preserve the context around an excerpt: titles, captions, dates and corrections can change its interpretation.
- 03
Document provenance
Keep public URLs, access times and transformations. Preserve useful files while respecting rights, personal data and local law. Record what was collected, how and under which preservation permissions. A file hash can help detect changes but does not establish that the contents are true. Limit personal data to the defined purpose.
- 04
Find independent evidence
Cross-check different source types: institutional publication, technical observation and primary document. Identify repetitions of the same dispatch or report. Build a small map of relationships between publications. Three sites citing the same release represent a distribution chain, not three observations. Seek confirmation that contributes distinct primary information.
- 05
Test alternative explanations
Look for reused old imagery, timezone errors or missing context. Metadata may be missing or altered and is insufficient on its own. Test a competing explanation before concluding: an old company name, a place with the same name, a superseded document or an out-of-context photograph. Record important negative checks so readers understand the limitations.
- 06
Write a proportionate conclusion
Separate facts, hypotheses and unknowns. Attribute statements, explain limitations and identify what could strengthen or refute the conclusion. An actionable brief separates observation, inference and open questions. It identifies the decision consequence, next verification and review date. Wording should remain proportionate to the evidence.
Worked example: an image is claimed to be recent and from a named city. Look for an earlier publication, then compare visible geographic features and available timing evidence. If the location is plausible but the date cannot be verified, preserve those conclusions separately. Cite the evidence supporting each and do not turn plausibility into certainty.
מקורות: נתונים, שימושים ומגבלות
מועד בדיקת התיעוד .
הערות המקורות המפורטות זמינות באנגלית במהדורה זו.
| מקור ומטרה | נתון או מדד מאומת | כיצד להשתמש | מגבלה שיש לשמר |
|---|---|---|---|
| FIRST · Traffic Light Protocol Indicate who may receive redistributed information. |
TLP 2.0 uses RED, AMBER, GREEN and CLEAR; AMBER+STRICT restricts sharing to the recipient organisation. Labels must not be translated. | Keep the marking with the information and check recipients before forwarding. Ask the source to clarify any ambiguity. | TLP is neither a formal classification nor a reuse licence. It does not guarantee content accuracy. |
| C2PA · Content Credentials Describe and verify certain content provenance information. |
C2PA specification 2.4 defines manifests, assertions and cryptographic binding mechanisms associated with media. | Examine what the manifest asserts, who signed it and whether validation succeeds. Test preservation after transformations and distribution. | Validated provenance does not establish the truth of a scene. Absence of a manifest does not demonstrate a fake. |
| ICANN · Registration Data Lookup Consult available domain registration information. |
RDAP is the registration data access protocol. ICANN Lookup provides access to available public registration data. | Keep the exact domain, consultation date and result. Distinguish registrar, technical service and the entity operating a website. | Data may be redacted or limited. Domain information alone cannot attribute content or an operation to a person. |
מקור מדיה ואימות C2PA
הערות המקורות המפורטות זמינות באנגלית במהדורה זו.
Separate technical trace, source and judgment
Verifiable provenance helps describe a file’s history. Analysts must still check contextual claims and the independence of documents repeating them.
- Associate each claim with its exact asset and source.
- Trace repetitions to origins before describing corroboration.
- Retain uncertainty and information that could change the judgment.
Open the C2PA explorer and publication cases →
References consulted on · C2PA · Content Credentials Explainer ODNI · ICD 203, Analytic Standards
OSINT: שימור ראיות
הערות המקורות המפורטות זמינות באנגלית במהדורה זו.
Usable intelligence retains the trail of its supporting material
Connect each conclusion to sources, preserved objects and working transformations. Custody complements corroboration; it does not turn unverified information into established fact.
- Describe observed scope, capture limits and date uncertainty.
- Separate preserved reference, technical copy and assessment extract.
- Expose unconfirmed transfers and analytical assumptions.
See copy lineage and the eight preservation cases →
Sources reviewed on · NIST · Digital Evidence Preservation · NIST IR 8387 · Full report · NIST · SP 800-86 · NIST SP 800-86 · Full report · NIST · FIPS 180-4 · Secure Hash Standard
עימוד: עקביות והתאוששות
הערות המקורות המפורטות זמינות באנגלית במהדורה זו.
Reconcile collection identities and revisions
An exit inventory or OSINT collection can reach the last page while missing an object or mixing its revisions. A total alone does not establish that expected data is present.
- Fix order, scope and consistency reference before reading.
- Compare IDs and revisions beyond row counts.
- Retain discrepancies and recovery decisions when the reference changes.
Compare computed reads and recoveries →
Sources reviewed on · Google · AIP-158 Pagination · PostgreSQL 18 · LIMIT and OFFSET · PostgreSQL 18 · Row constructor comparison · PostgreSQL 18 · Transaction isolation · OWASP · API1:2023 Broken Object Level Authorization

