How an investigation reads the trace - and how protection scrubs it
A raw photo carries the GPS coordinates of where it was taken
OpenAn Office file or PDF carries the author, the tool and an internal path with a real login
OpenThe same rare handle across different platforms ties accounts back to one person
OpenA sockpuppet avatar surfaces elsewhere - in a stock library or an old captioned profile
OpenA hidden self-hosted fingerprint ties together the sites run by one person despite masked WHOIS
OpenOne domain was left unmasked - and the registrant email stitches the rest together
OpenThe posting rhythm reveals the real timezone despite the city claimed in the profile
OpenThe same email and a reused password in dumps stitch a pseudonym to a real account
Open