About
I work in open-source intelligence and cyber security: finding, verifying and documenting things that are publicly available but hard to see.
What I work on
Open-source investigation. Tracing people, companies, aircraft and vessels through public records, corporate registries, and the traces that everyday systems leave behind.
Verification. Establishing whether an image, a video or a claim is what it says it is — where it was taken, when, and by whom. Geolocation, reverse image analysis, and metadata forensics.
Geospatial and satellite analysis. Radar and optical change detection, QGIS tooling, and turning coordinates into something an analyst or an editor can act on. The PWTT QGIS plugin walkthrough covers the same radar-based damage-detection method behind Bellingcat’s damage maps, written so you can run it at home.
Tooling. I build what I need and release the parts that might help someone else — a Google Maps exporter for pulling public maps out as KML, KMZ or GeoJSON; a Dockerised deployment of Bellingcat’s ADS-B history stack; a Wigle to Google Earth converter. All of it is under the projects tag.
Writing
The blog runs from 2018 to now and mixes investigation write-ups, tool documentation, conference notes and CTF solutions. The practical guides are written to be followed by someone who is not a developer — if a step needs a terminal, it says exactly what to type and what you should see back.
Talks and conference material include Recon Village at DEF CON 29 and NCPTF 2021, and the longer-form State of OSINT piece on where the field is heading.
Get in touch
For consulting enquiries, collaboration, or anything about a post here: contact@salaheldinaz.com
For anything sensitive, my key is on Keybase — please encrypt before sending.