THE DEFINITIVE GUIDE:

TikTok for OSINT

Investigation
 TABLE OF CONTENTS
I NT R O D U C T I O N
3
Profile Discovery
4
Content Extraction
7
Applied Analysis
13
Expanding the Scope
17
Expanding the Investigation
19
 INTRODUCTION
TikTok is the fastest growing social media platform on the internet.
Quickly encroaching 1 billion active users, TikTok is becoming the social
media platform of choice in the 15-35 age demographic. From an open
source intelligence (OSINT) perspective, TikTok is a treasure trove of
valuable data, including photos, videos, audio, social networks, and
more. This guide will show you how to discover profiles on TikTok,
extract content from profiles found, apply analysis to the information
found, and expand your investigation from TikTok and beyond all within
the constraints of your web browser. No mobile phones or emulators are
required.

Investigative Limitations of TikTok on Desktop

Similar to Snapchat, TikTok is a mobile-first app; however, unlike
Snapchat, it does have a desktop version. For the sake of this guide,
we’re going to use the desktop version to discover and extract content.
You can use a mobile device or emulator, and for certain data points,
you have to, but it’s much easier to extract content at scale using tools
available on a desktop. This will make much more sense later on in this
guide. The TikTok website for desktop has many limitations. This means
we’re going to use various tools and techniques to still get the
information we’re looking for.

3 THE DEFINITIVE GUIDE: TIKTOK FOR OSINT INVESTIGATIONS

 1

PROFILE
DISCOVERY
This chapter will teach techniques to
find user profiles using a desktop and
how to access the information needed
for an OSINT investigation.

4 THE DEFINITIVE GUIDE: TIKTOK FOR OSINT INVESTIGATIONS

 T
ikTok’s homepage doesn’t have a search
engine. When you visit the home page, you
only can see the top-grossing accounts and
topics or download the mobile app. For most
investigative purposes, this isn’t helpful.
Fortunately, Google indexes pages on TikTok, and
we can use Google Search (or any other search
engine) to look for specific information on TikTok.
Let’s take a look at a few methods for profile
discovery.

site:tiktok.com“{first + last name}”OR “{username}”

Using Google Search, we can use the site:
operator to filter our results to show only the
website we specify. In the example above, we
used site:tiktok.com to only show results from
Searching for users (a)
TikTok. By replacing {first + last name} with the
subject in your investigation, you can search the
You can enter as many first and last names or usernames as you’d like. Make
entirety of TikTok specifically for the person
sure to add the OR operator between each identifier; otherwise your results
you’re looking for. If it’s a more common name,
will get narrower instead of broader. Here’s an example.
like John Smith, you’ll have to add additional
identifiers; however, if it’s a unique name like
-site:tiktok.com “{first + last name}” OR “{username}” “tiktok.com”
Jake Creps, you’ll find much fewer results that
Let’s say that you tried the first method and nothing came up. That’s okay
are easier to verify. By adding the OR operator,
and pretty typical. People will often use different display names and
you can tell Google to search for two things at
usernames across different platforms. We’re going to have to get more creative
once without requiring both of them to be
in these situations to find who or what we’re searching for.
present on the page. So if you enter
site:tiktok.com “John Smith” OR “soccerfan247”,
Google will search for mentions of John Smith OR
soccerfan247 on TikTok.

5 THE D EFINITIVE GUIDE: TIKTOK FOR OSINT INVESTIGATIONS

 Using the -site: operator, you’re telling Google to
check every other website except for TikTok. We’re
going to use the same name and username inputs
here; however, we’re going to add “tiktok.com” at
the end of the query. What this will do is it will look
for all other websites where that name or username
can be found, and it will also check for mentions of
tiktok.com. This will find users mentioning their
TikTok profile on Instagram, Twitter, YouTube, or
any other platform. Notice that there isn’t an OR
operator in between “{username}” and
“tiktok.com.” This is intentional. We’re looking for
any combination of name OR username, but the This search contains “tiktok.com” to search for other sites (a)
results must include tiktok.com. We don’t have to
specify the AND operator because it’s the default
operator on Google. Here’s an example (a).

tiktok.com/@{username}
The last method for profile discovery is the most
basic. TikTok uses the same URL structure for every Searching usernames directly with tiktok.com/@username (b)

profile page. If you have a list of usernames or

emails and want to check if that username has a
TikTok profile, simply add the username after
tiktok.com/@ and see if the profile has information
matching what you already know. Don’t forget to
add the @ in the URL. Without it, you’ll get a 404
page. Here’s a correct example.

6 THE D EFINITIVE GUIDE: TIKTOK FOR OSINT INVESTIGATIONS

 2

CONTENT
EXTRACTION
This chapter will show methods to extract
the content from profiles for easy analysis
once data collection is complete.

7 THE D EFINITIVE GUIDE: TIKTOK FOR OSINT INVESTIGATIONS

 Once a profile that matches the subject in the
investigation is found, it’s time to start
extracting as much data from that profile as
possible. Here is where using the desktop
version of TikTok limits the amount of
information that is accessible. However, it’s a
great place to start an investigation. If the
investigation allows and warrants it, it is
possible to expand to the mobile version of
the same TikTok profile using a mobile device
or emulator. This guide will cover that in
future chapters. First, let’s discover what can
be extracted from the desktop version. Right-click to open photo in a new tab (a)

Profile Pictures
Unlike Facebook, TikTok only allows users to
post one profile picture. Unfortunately, this
means if the user changes their profile
picture, it’s effectively lost. If an internet
archive of the page doesn’t exist, there’s no
other way to recover that image. For this
reason, it’s essential to download that image
and archive it for evidence collection
purposes and to establish a timeline
throughout the investigation in the event the
picture changes. Previously, downloading
profile pictures on TikTok was more difficult.
Now it can be done by simply right-clicking
the image, opening it in a new tab, and downloading
Right-click to save image to storage (b)
it in its full resolution.

8 THE D EFINITIVE GUIDE: TIKTOK FOR OSINT INVESTIGATIONS

 Now that we’ve downloaded the profile
photo, the next step is to copy the username, display
name, following count, follower count,
like count, profile description, and social
media links. Unfortunately, the following,
follower, and like lists are unavailable on
desktop. If that list is essential for the
investigation, using a mobile device or
emulator will be necessary. When setting up a profile,
TikTok allows users to link their
Instagram or YouTube to their TikTok profile Information included in a TikTok profile
page. This is a great pivot point and a
verifiable way to link two accounts together.
It’s important to know that not all users link
their profiles, so just because one isn’t listed
doesn’t mean it doesn’t exist. This process
shouldn’t take more than a few seconds. It is
easiest to either copy and paste the text, take
a screenshot, or both.

9 THE D EFINITIVE GUIDE: TIKTOK FOR OSINT INVESTIGATIONS

 Videos
Videos are the bread and butter of TikTok.
Unlike other platforms, almost all of the
content on TikTok is user generated.
Because of this, the subject of the
investigation is very likely to be in these
videos. Finding connections, behaviors, and
locations and establishing a timeline can be
done by analyzing the videos found on
TikTok. It is important to download them off of
TikTok to archive them in the event the user
takes them offline. Unlike profile pictures,
it is impossible to right-click on videos to
download them. First, it is required to isolate
the video on a separate page to download
the source video. Here’s how to do it.

Start by clicking on the required video.

Doing so will open a pop up showing that It should be directly above the highlighted elements on the page (as
video, the video description, sound file, and shown above). Right-click on that link and open it in a new tab. This new
engagement summary. page will allow the video to be downloaded directly to your local
storage. TikTok has made a variety of changes to their desktop version this
Right-click on the video and choose year. If an error occurs while trying to access a video, try again later or try a
“Inspect.” For this guide, Google Chrome different browser.
was used, but this will work on any browser.
Next, a panel that has a list of links will show up Repeat this process for every video on the profile of interest until all videos
on the page. Find the one that includes have been downloaded.
“v-16-web.tiktok.com” in it.

10 THE DEFINITIVE GUIDE: TIKTOK FOR OSINT INVESTIGATIONS

 Video Descriptions Searching for any hashtag just requires
Each video posted on TikTok has a description. replacing everything after tag/, in this case,
Within that description, users often post “sanfrancisco,” with any other topic of choice.
hashtags and other accounts mentioned; Using trending hashtags on other social media
however, there is also a link to the sound used profiles can be useful to find relevant content
in that video. These are all data points that will on TikTok. Location names are often
be valuable for the investigation. Let’s start with searchable hashtags because many TikTok
mentions. users will tag the city they live in to get more
visibility. Here’s an example.
TikTok doesn’t hyperlink mentions on the
desktop version. It is required to copy It is important to access and understand the
usernames in the description and paste them date stamp of the video in question. TikTok
into the TikTok URL structure mentioned before previously allowed users to see the exact date
to pull up the new profile. Once completed, the and time a TikTok video was uploaded. That
same content extraction process can be used on information is no longer available in the source
the new profile as was done on the first. code. Now, only the month and date that a
video was posted is available. That information
The next step is to find hashtags. Hashtags are is located directly to the right of the display
hyperlinked on TikTok for desktop. Once name, above the video description.
clicked, they’ll open a new page showing all
content that used that same hashtag.
Effectively, this is the unofficial hashtag search
engine of TikTok. When looking at the URL of
the page after clicking on a hashtag link, it will
look like tiktok.com/tag/sanfrancisco.

11 THE DEFINITIVE GUIDE: TIKTOK FOR OSINT INVESTIGATIONS

 Lastly, there’s the video’s audio. This feature is
unique to TikTok. They encourage users to take
audio from someone else’s video to use for their
own video. This was originally intended for songs;
however, it’s used for all types of audio from
speeches to impersonations to music and
everything in between. By clicking on the audio link
in the image, a list of all users that have used the
same audio in their video is available. For popular
songs or celebrities, this list could be hundreds of
other videos. With smaller accounts or regular
users, this might only be a few videos. Here’s an
example.

Through this, it is easy to start creating and

analyzing social networks or reverse-engineering
Original sounds can lead to social networks
viral content. That leads to the next section on
applying these discovery steps.

12 THE D EFINITIVE GUIDE: TIKTOK FOR OSINT INVESTIGATIONS

 3

APPLIED
ANALYSIS
Now that all available content on a
TikTok profile has been distracted, it’s
time to perform applied analysis.

13 THE DEFINITIVE GUIDE: TIKTOK FOR OSINT INVESTIGATIONS

 Profile Picture
The first thing to mention is that TikTok
automatically removes the EXIF data of a profile
image, so there is no additional data from the
picture by analyzing the metadata. The next
step is to conduct a reverse image search. The
best practice for this is to use Google, Bing, and
Yandex. Google might be the best for search
but can fall short on reverse image search. This
will give you reverse image results if the subject
is using the same image on other profiles.
Doing so will also help get a better idea of how
old the picture is or any additional information
other platforms may offer. By doing this, we can
identify other personal accounts, alias accounts Source: checkgmailavailability.com
and establish a more clear timeline for the
investigation. Here’s an example.

Biographical Information Many social media platforms will use the same username as the user’s email
The most valuable identifier on TikTok, when it address, if available, by default, but some users will change this to match
comes to reverse searching, is the username. their other profiles. Both of these scenarios are helpful for investigators.
People often use the same username across Reverse searching the username from TikTok will generally help find
multiple profiles. This tends to be true not only additional social media profiles. Alternatively, suppose the TikTok profile has
for influencers or influencers to-be but also for a username that doesn’t match the username of social media profiles that
regular accounts. belong to the same subject. In that case, an email verifier tool can be used to
see if that username matches a common email provider such as Gmail,
Outlook, Yahoo, Protonmail, etc.

14 THE DEFINITIVE GUIDE: TIKTOK FOR OSINT INVESTIGATIONS

 Because TikTok allows users to connect their Having these dates is the first step in building
Instagram and YouTube profiles to their an entire timeline when the subject is active
TikTok page, an investigation can quickly online. Beyond just a basic timeline, it can
expand to those resources to find additional help piece together where the individual was
content. Likewise, as mentioned above, around the time the video was posted.
identifying if the TikTok username matches
an Instagram profile or YouTube channel can be If the subject’s address is known, verifying if
done manually. This guide will cover how to the video was shot at home can be done by
expand an investigation beyond TikTok analyzing the property. By checking for major
and cover techniques and tactics to get the landmarks, it can be determined where the
most out of that process. subject shot the video as well. TikTok videos
sometimes include multiple individuals. If the
Many people online also use the same main subject cannot be identified, it’s
profile description for all of their social media possible to identify associates and
accounts. If not the exact description, they connections and find the main subject
copy elements of that description. Searching through them.
for the exact description on Google using
the quotes operator can help to find other Because the date only reflects when the user
profiles from the same user. However, it is posted the video to TikTok, there could be a
also helpful to break the description apart, gap between production and publication.
sentence by sentence, and search for that Many users will use the TikTok app to record
individually. Here’s an example. their videos; however, they can record them
in advance and publish the video later. Keep
Videos this in mind before confirming a timeline.
Videos on TikTok are likely to be where the
most valuable information is found when
analyzed. TikTok already gives the date that
videos are published.

15 THE DEFINITIVE GUIDE: TIKTOK FOR OSINT INVESTIGATIONS

 Video Descriptions Lastly, audio can show who is intimately
Video descriptions on TikTok are composed of engaging with someone’s video. Using audio
three main elements, as described before. from another video is more than just a like or a
Hashtags, tagged users, and audio. Some comment; it is someone taking their video
hashtags are global and viral; however, some and creating original content from it. TikTok
are local and more individualized. Look for the allows users to add original sounds, like a
local and individualized ones. This will give speech or a joke; however, they also let users
clues as to where the individual might live, what add popular music or anyone else’s audio.
events they’ve attended, or who might be in These can be found as audio clips labeled as
their immediate or adjacent social network. “original sound.” If someone else uses the
Tagged users are a bit more straightforward. original sound for a non-celebrity, more
Suppose the main subject is being more localized account, the likelihood that person is
elusive. In that case, using individuals tagged in in their social network is much higher.
their TikTok videos to expand the investigation,
potentially finding more information about the
main subject and their social network.

16 THE DEFINITIVE GUIDE: TIKTOK FOR OSINT INVESTIGATIONS

 4

EXPANDING
THE SCOPE
Next, learn what other social media networks
can be easily searched from the information
gathered from TikTok and how to create a more
complete timeline of your subject's social life.

17 THE D EFINITIVE GUIDE: TIKTOK FOR OSINT INVESTIGATIONS

 Once a subject’s profile is identified on TikTok,
all of the content has been extracted, and the
analysis process has begun, it’s important to
recognize that the investigation isn’t over and
there might be other
information potentially available. Remember
that you can tag other users in videos on TikTok,
but it is also possible to search for videos that
the subject was mentioned in. This is a bit
trickier but can be done. By
searching Google’s index for mentions of the
Extracted username list (a)
username, {@username}, within the text of the
page while simultaneously filtering out the
The -site:tiktok.com/@{username} (replacing {username} with your subject’s
subject’s TikTok profile, the exact results can be
username) command tells Google to remove all results that come from the
found. Here’s how it’s done.
subject’s profile. The -intitle:”{display name}” is added to remove links that
list the TikTok user’s display name in the web page title. Lastly, the
site:tiktok.com -site:tiktok.com/@{username} -
intext:”@{username}” tells Google to look for a username match within the
intitle:”{display name}” intext:”@{username}”
text of the page, specifically in the video description. Here’s an example.

Using this search technique is a bit more

This technique is about 90% effective. There may be cases where the
complicated, so let's break it down. The
subject’s profile still appears because of the variety of URL structures TikTok
site:tiktok.com command tells Google to only
uses for mobile and tablet viewing. It is possible to filter these out also, but
show TikTok in the search results.
the 90% solution is acceptable for most investigations.

18 THE DEFINITIVE GUIDE: TIKTOK FOR OSINT INVESTIGATIONS

 5

BROADENING THE
INVESTIGATION
This chapter is about going beyond social
media and going one level deeper into
your investigation through automation

19 THE D EFINITIVE GUIDE: TIKTOK FOR OSINT INVESTIGATIONS

 Thus far, this guide has shown best practices
for identifying, extracting, analyzing profiles
and how to expand the scope of an
investigation to factor in other user’s
mentioning a subject. This final chapter is how
to broaden an investigation beyond TikTok.
While TikTok allows users to connect an
Instagram or YouTube channel to their TikTok
profile, many users don’t use this feature. Yet,
because TikTok assumes the user might, we
should too. If they don’t, an alternative method
is needed for finding other accounts. Using this Extracted username list (a)
query can verify that assumption.

The “{username}” OR “{first + last name}” command looks for the name or
site:youtube.com OR site:instagram.com
username of the subject. The “tiktok” OR “tik tok” OR “tiktok.com/@{username}”
“{username}” OR “{first + last name}“ “tiktok”
command tells Google to look for mentions of the word tiktok, tik tok (spelling
OR “tik tok” OR “tiktok.com/@{username}”
variation) or the exact URL of the subject. These three commands are chained
together by an understood AND operator, so we don’t have to specify it. Here’s
This will be the largest Google query covered in
an example.
this guide, so it’ll be step by step. The
site:youtube.com OR site:instagram.com tells
Google only to show results for YouTube or
Instagram.

20 THE DEFINITIVE GUIDE: TIKTOK FOR OSINT INVESTIGATIONS

 This query will only yield results that include Using a tool like Skopenow can automate
content from YouTube or Instagram that each process outlined in this guide.
match the subject’s specific identifiers (name Skopenow will automatically conduct reverse
and username). It is important to explore this username searches across all social media
content, looking for deleted videos, platforms and expand the search using
username changes, comments, likes, and publicly available information from 1000’s of
other evidence that can be used in the sources. Skopenow will automate the
investigation. After verifying Instagram and collection, archive the followers and follow
YouTube, expand to LinkedIn, Twitter, lists for further investigation. Lastly,
Facebook, and other available profiles. Skopenow’s automatic report builder will
Building a holistic social network for a save time organizing the hundreds of data
subject requires information that might not points collected in a clean and organized
be found on a more public profile like manner.
TikTok. Expand timelines to include content
before (and sometimes after) the most Contact us for a demo to see how Skopenow
recent TikTok video. Discover new locations can streamline your OSINT workflow.
the subject has been, groups they’re a part
of, or topics they’ve discussed. Create a
robust investigation that produces
actionable intelligence.

21 THE DEFINITIVE GUIDE: TIKTOK FOR OSINT INVESTIGATIONS