How OSINT reunited two long-lost soldiers

Every day for nearly ten years, my friend Bill Stevens has been trying to find and reconnect with his army buddy, with whom he fought more than 20 years ago. For several years, Bill posted his messages on Facebook, accompanied by photos from the past, hoping that somehow his post would go viral and the news would reach his long-lost friend... but it never happened.

I've known Bill for a very long time, and over the past few years, I've been reading more and more disappointing messages asking for someone to help him. Every year I wondered if I might get lucky and try to help with the search. After all, I make a living finding people on the Internet, but finding "Eric Garcia," whose whereabouts were last known more than 20 years ago? It's like looking for a needle in a haystack!

On November 11, 2022, Bill's request reappeared in my Facebook feed. Incidentally, the fall of 2022 coincided with the 5th anniversary of the death of my best friend and Army veteran, Chad Jolson. Chad and I spent our youth inseparable, like two peas in a pod, and the two hardest moments of my life, when I cried the most, were the day he went to basic training and the day I gave the eulogy at his funeral. I carry this tattered photo of him in my wallet every day for nearly a quarter of a century and still think about him constantly.

Perhaps it was just a coincidence of timing, or maybe it was simply fate, but this time I decided to reach out to Bill with a proposal to try to find his long-lost friend. I know how strong the bonds are that connect these brave men and women in our army, and it is quite clear that this person meant a lot to Bill. It is very unlikely, but if I can somehow help them be together again, well... I want to try.

I contacted Bill and asked him to remember anything that could help me find "Eric Garcia," because you never know when the smallest detail can make a significant difference when it comes to OSINT work. Unfortunately, at the beginning of the search, I had very little information:

Name: Eric Garcia

Location: Fort Gordon, Georgia (1998-1999)

Previous location: Colorado

Company: Foxtrot 369

That's it. That's all we have to work with here.

It would be impossible for me to understate the number of failures that followed, as I spent many hours on fruitless searches.

I started with the basics: asked a few friends in the army if there was any publicly available database, and got a resounding "no." Then I focused on Foxtrot 369, browsing unit pages, Facebook groups, online articles, and anything I could get my hands on. After several hours of searching this route, nothing yielded results.

After that, I went the usual route of searching for people on websites, browsing the contact information of every "Eric Garcia" I could find associated with Fort West. Gordon, Georgia, or the state of Colorado, who was born around 1980. Do you know how many people there are?? Attention, spoiler... IT'S JUST A BUNCH OF CRAP.

It is well known that I am stubborn almost at an Olympic level, but at this stage, I think I may really have to step down and admit defeat. I really don't see how it's possible with the little I have to work with. Having exhausted practically everything I could think of, I'm afraid it seems to have gotten the better of me.

This drives me crazy.

I hate to fail. It's time to dig deeper.

Whenever I get stuck in an investigation, I always use the same approach... I go back to where I started and analyze where I started, looking for missed ways to work with the information I have. At this point, it occurs to me that I have one piece of information that I haven't studied at all yet...

The photograph itself!

Specifically, the face of "Eric Garcia". Yes, these photos are old, and yes, they are just a regular picture and not very high quality, but these days there are many free open-source facial recognition options, as well as for upscaling low-quality photos. Some of these sites are focused on finding images taken from one specific platform, while others use much more extensive databases. In rare cases, search engines can achieve some success in finding a face, although they are not very good.

Before visiting or using any of these sites, please be aware of the risks, laws, and policies that may govern your access to or use of them. I am not your lawyer and not your boss!

I'm looking through several open-source facial recognition options, including search engines, and - BOOM!... one of them gives me very promising results!!

Holy crap!!! What is this?

No way!

To my inexperienced eye, this certainly looks like a promising result, but these days we don't need to rely on my useless opinion, we have a number of free AI-based face comparison tools, such as Amazon's "Rekognition". Let's see what AI has to say about whether this matches the "Eric" we're looking for...

99.8%? Then okay!

After countless hours of frustration and nearly giving up on what I really wanted to solve, I finally have something to work with!

There is only one problem.

The links to the photos are intentionally cropped. You see, this site is willing to provide me with only a teaser for free, but they want me to sign up for their service and pay them for the full results. Crap!

It's time to do what we do best. Get creative...

The part of the URL I see indicates that the domain starts with "hitched". Judging by the look of these photos, I think they are from some official event... naturally, one where people get "hitched". I suppose he might just dress very dapper in everyday life, but even I (whose personal style is best described as "middle-aged dad nostalgic for the Midwest") can tell that this is most likely from a wedding, not how people dress in everyday life. While I can't rule out the possibility that he will later become a famous men's fashion model, I decide to start with wedding photography.

I need to find these photos on the internet, but how? I immediately wonder... could these results have been indexed by a search engine? Do I have enough data to find them without the full website name?

Using the most fundamental OSINT skill - Google dorking, I create query after query, using the search operator inurl: combined with the word hitched, and come up with several potential keywords that I hope might lead me to the right site. Using this search operator, I ask Google to limit search results to only URLs containing the word I specify (hitched), and combine it with searches for other keywords that interest me. These queries would look something like this:

inurl:hitched wedding photography

When I start browsing the results, I realize that it is inefficient for me to browse all their websites as I find the ones that interest me. I really need to be careful if I am going to find that needle I am looking for! What if I ask Google to do the heavy lifting for me again? Perhaps with a Google Dork that will make Google search only what is indexed from each of these sites that interest me, focusing on the keyword Eric. It would look something like this (for a site named hitched.com, which was not the site name):

site:hitched.com eric

This is a case where making no assumptions in your work sometimes pays off. If you noticed, I enclose "Eric" in quotes throughout this blog. Wonder why?

The reason is that when I research something, I start with a broad search, making as few assumptions as possible, because over the years something like this has happened to me more than once:

While browsing Google search results for a particular photographer's site, I noticed something... One of the entries was for Eric + [Bride]

(I removed her name for privacy reasons, and from now on I will just write [Bride])

Really? I look closer...

Hell. Yes!

It turned out that I was given the wrong spelling of the person I was looking for. His name is Erik, not Eric. How about that extra level of complexity?

But honestly... What luck!

So, a short break to watch TV shows. Let this be a useful lesson for those of you who use really complex Google dorks to find exactly what you're looking for... Sometimes it's a double-edged sword. When you're "dorking," consider whether it's worth being as restrictive as possible to get the result. For example, I could easily put the name Eric in quotes in my query so that Google returns only results with that specific name, but I might accidentally miss what I was looking for because of filtering out any variant with Erik. Google does me a favor by offering so-called "fuzzy search," which gives similar results. Sometimes it's annoying, but in cases like this, it's useful!

You can always add more specifics to your search queries as you go along, and in this case, I just needed to fully restrict the "site:" part of my query.

So, let's summarize what I have so far...

After looking at the wedding photos, I learned the names - Eric and [Bride] Garcia, I know what they look like, I know their wedding on August 3, 2013, took place at a well-known location in San Pedro, California, I know the name of the photo company in Los Angeles that took their pictures, and... and nothing else. Do you know how many Eric Garcias and [Bride] Garcias live in and around Los Angeles (California)?

As you guessed! A CRAP TON!

My first instinct was to look at the photographer's social media. Surely the groom or bride would have liked one of the photographer's social media accounts or they would have followed him, right? Wrong. Even more time wasted.

I wonder if the photographer posted in 2013 advertising their beautiful photo and happy couple. That's exactly what the bride and groom might have liked, right? Let's find it! I go to the photographer's Facebook, use the timeline filter feature to go back to 2013, and voila, I find the post I was looking for:

Only... they didn't like it. And didn't comment. Neither they nor their friends. Damn!

At this stage of the story, I'm once again trying to spin like a squirrel in a wheel. A lot. I'm looking at online reviews of the photography business, the wedding venue, browsing social media pages, studying posts, comments, and reposts. I'm grasping at straws and nothing I try is working.

Remember what to do when you hit a dead end?

Step back.

So, I go back to the photographer's post above and ask myself, what else can I work with? What can be turned around? What is unique? What did I miss? And then I see it...

#TheSepulvedaHome

This place has a hashtag! This opens up completely new possibilities for me because now I'm studying a wider range of social networks looking not only for Eric and [Bride], but for any of their wedding guests who posted photos with the hashtag #TheSepulvedaHome on August 3, 2013. If I can find at least one wedding guest, I might be able to get into one of their social media profiles!

So, I enter a hashtag search on Facebook, go back to 2013, and find this post...

Here it is. Exactly what I was hoping for! A perfectly preserved memory with the right date, the right hashtag, and a mention of the exact couple. Oh, and as a bonus, there are also a few tagged guests. Jackpot!

By the way, looking back, I realize that this was a "right place at the right time" story because a hashtag search on Facebook now yields only a handful of results, and there's no longer an option to filter by year like before. If I were doing this research today, I might literally hit a dead end. Thanks, Facebook, for constantly changing your best features for OSINT! #RIPgraphsearch

Well, even rewriting this now, I'm still a little proud of myself, so I'll just stick this little meme here:

Well, seriously... Reaching out to an acquaintance using the wedding venue hashtag??? If I live a thousand years, I might never use this trick again! But the thought process that made me stop, review the available resources, and find another approach? Damn, I might repeat this tomorrow, and hopefully, you will too.

At this stage, I expected to start my typical social media research, find Eric and the Bride's accounts, and use them to help Bill get in touch. Pretty simple, right?

Not surprisingly, it turned out to be more complicated than expected.

Exploring the wedding guests' profiles for publicly available information, I eventually find several wedding photos mentioning an interesting username. A username that vaguely resembles the bride's name or could even be her pseudonym. Hmm... These are not tags like the ones you usually see on Facebook, where a person's name is a hyperlink leading to their profile; it probably came from a linked Instagram profile of a wedding guest who posted. This is a feature of the two Meta-owned companies that allows cross-posting content on both platforms. Instagram uses mentions with @ in its posts, so I go to Instagram and find the Bride's account using the mentioned username from Facebook.

The profile (which is now private) had many photos over the years, but the further I scrolled down, the more obvious the absence of something important became... Eric. I was quite sure I found the Bride since she is in the wedding photos, but she uses a different last name on social media, and I start to suspect that perhaps the marriage ended at some point, and that's why I don't see him. Could this ultimately be a dead end?

With this in mind, I go back to the posts from the fall of 2013 to see if anyone comments who could be Eric, or if a friend mentions Eric or tags an account that might no longer be a hyperlink, as this could be useful for further research. Again, persistence pays off...

Following the tagged profiles in the comments to this post, published just a few weeks after the wedding, I go to the tagged Instagram user @h8[deleted]

The profile picture is not very good, but it really does look a lot like the Eric I'm looking for. Now that I know he might be a veteran electrician from Local 47, I might be able to find other sites with information about him that I can pass on to Bill. Going back to Google search using keywords works again!

WAIT A MINUTE!

Sean??? You must be kidding. Not only did I start with the wrong spelling of Eric's name, but now it turns out it's not even his first name? If someone came up to me and said, "Hey, I want you to find this guy I knew 20 years ago, but I'll only give you his middle name and last name, and one of those names I'll spell wrong," I'd say...

And yet, matching the original photo with the wedding photo and the LinkedIn photo, I see the truth right on the screen. Bill's long-lost friend, "Eric Garcia," is actually Sean Eric Garcia.

I've found my needle.

From here I have more than enough information to move forward and start using regular people search sites, using Eric's name, age, hometowns, and so on. It wasn't long before I found a couple of email addresses, physical addresses, and phone numbers to check. All of this was packaged together with social media accounts and sent to a very happy Bill.

A few months after I shared all this information with Bill, I learned that he had successfully used it for the long-awaited reunion he had been looking for.

Once again, the power of OSINT saves the day.

I would like to conclude and thank Bill and Eric for allowing me to tell this story. I also want to acknowledge Bill, Eric, Chad, and every brave and selfless person who courageously put their lives on the line for the freedoms we have.

Materials with OSINT tools:
Search by email and nickname
Telegram account analysis
Bots and services for data reconnaissance on VKontakte
Reconnaissance by Telegram bots — OSINT on Telegram
Useful web resources for OSINT
Bot OVERLOAD and search for user groups on Telegram