Situational Awareness – OSINT and Awareness
In the military we learned early that the integrity of your kit matters as much as the integrity of your intel. A contaminated weapon system or a compromised radio can get people killed. The same principle applies when you step into open-source intelligence work.
Too many of us jump straight into browsers and search engines on the same laptop we use for email, banking, Amazon, and family photos. That machine already carries cookies, cached logins, tracking data, temporary files, and a digital fingerprint that ties your real identity to every query you run. If that investigation ever ends up in a courtroom, a client report, or even a simple after-action review, the opposing side—or a curious adversary—can demand the machine. Suddenly your personal life is on display next to the operational data.
The solution is simple in concept and non-negotiable in practice: maintain a dedicated machine used only for investigations. No personal accounts. No casual browsing. No “I’ll just check my email real quick.” Treat it the same way you would a clean forensics workstation or a sterile weapons range.
Start with a Clean Host
Whether you are running Windows, macOS, or Linux, the first move is a complete wipe and fresh install. Back up anything you actually need to keep, then erase the drive. On Windows 10 or 11 use the built-in recovery option and choose “Remove files and clean the drive.” On macOS use Erase All Content and Settings. On Linux boot from a clean USB (Ventoy makes this easy) and install a fresh copy of Ubuntu or your preferred distribution.
Refuse the online account prompts during setup. Use a generic local username and a strong password that exists nowhere else. Disable every telemetry and data-sharing option you can find during the initial configuration.
Core Protections
Once the operating system is clean, layer on the basics:
- Antivirus and antimalware. Windows Defender plus a weekly Malwarebytes scan is sufficient for most. On macOS install Task Explorer, KnockKnock, and ClamAV through Homebrew. On Linux use ClamAV. Schedule regular scans.
- Telemetry control. Microsoft and Apple collect far more than most people realize—keystrokes, location, browsing history, even webcam data in some cases. Tools such as O&O ShutUp10 on Windows or Little Snitch / LuLu on macOS let you cut the majority of that traffic.
- System cleaner. BleachBit (or a carefully generated Privacy.sexy script on macOS) removes leftover temporary files, browser residue, and other digital debris. Run it weekly. Do not use the “wipe free space” option unless you have time to spare.
- Virtual Private Network. Use a reputable paid VPN on every device that touches the internet during investigations. Proton VPN and Private Internet Access are proven options. Route all traffic through it. A free VPN is not an acceptable substitute.
- Offline password manager. KeePassXC is the right tool for this work. Create a strong master password, store the database only on the host or an encrypted USB, and generate unique long passwords for every covert profile and research account. Never sync investigation credentials to the cloud.
Why This Matters for Veterans
Many of us already operate in the gray space between personal preparedness and professional situational awareness. Whether you are monitoring local threats, supporting a veteran network, building open-source products, or simply staying ahead of the information environment, your digital footprint is part of your force protection. A contaminated machine can burn a source, expose a family member, or hand an adversary a ready-made profile of your interests and movements.
The work required up front is not glamorous. Reformatting a hard drive, configuring telemetry blockers, and building clean virtual machines takes time. That time is repaid the first time you need to stand behind your findings or the first time someone tries to follow the digital trail back to you.
Treat your OSINT workstation the same way you treated your weapon, your radio, and your load-out in the field. Keep it clean, keep it dedicated, and keep it ready. The investigation starts long before the first search query. It starts with the machine you choose to trust.
Microsoft Windows Host
Complete System Wipe
Back up every file you actually need. Connect an external drive and copy documents, configuration files, and media from the Desktop, Downloads, and Documents folders.
Once the backup is secure, perform a full wipe. On Windows 10 go to Start → Settings → Update & Security → Recovery → Get started under “Reset this PC.” Select “Remove everything,” then choose “Remove files and clean the drive.” On Windows 11 the path is Start → System → Recovery → Reset PC; select the option to remove your files and choose the local reset if available.
If the machine is older or the recovery option is missing, boot from original installation media or a manufacturer restore disc. During setup refuse any Microsoft account. Create only a local account with a generic username and strong password. Disable every privacy and data-collection option presented on the first-run screens. Keep the machine offline until the wipe and initial configuration are finished.
Antivirus & Antimalware
Leave Windows Defender enabled. Supplement it with Malwarebytes free edition.
Navigate to malwarebytes.com, download the free version, and install with default settings. Decline any premium trial. Update the definitions and run a full scan. Schedule a weekly scan thereafter. These two tools form the minimum reliable baseline for a Windows OSINT host.
Telemetry
Microsoft continuously collects keystrokes, location data, browsing history, media indexes, and more. Install O&O ShutUp10 from oo-software.com.
Launch the tool. In the Actions menu select “Recommended and somewhat recommended.” Then enable the “Microsoft OneDrive Disabled” option. Close the program and reboot. After every major Windows update, reopen ShutUp10 and re-apply the same settings. Red icons mean the service is blocked; green means it is still active.
System Cleaner
Use BleachBit (bleachbit.org). Install it, then select every available cleaning option except “Wipe Free Space.” Run the cleaner weekly. This removes leftover internet history, temporary files, and residual data without the multi-hour free-space overwrite.
VPN
Install a reputable paid VPN client (Proton VPN or Private Internet Access). Connect the VPN before any investigative activity and leave it running for the entire session. Route all host traffic through the VPN application rather than a browser extension. Maintain accounts with both providers if possible so you can switch when a site blocks one service.
Password Manager
Download KeePassXC from keepassxc.org. Create a new database, move the encryption slider fully to the right, set a strong master password used nowhere else, and store the database only on the host or an encrypted USB drive. Never sync the investigation database to the cloud. Generate unique long passwords (40+ characters) for every covert account and research profile. Keep a verified offline backup of the database file.
Apple macOS Host
Complete System Wipe
Back up needed files first. Open System Settings, search for “reset,” select Transfer or Reset, then Erase All Content and Settings. Enter your password, confirm, and allow the device to reboot.
During the setup screens: skip Wi-Fi if possible, choose “Not Now” for accessibility and migration, decline Location Services, disable all analytics, uncheck Ask Siri, and set up Touch ID or Screen Time later. Provide a generic computer name and a strong local password. Finish setup offline when feasible.
Rosetta
If the machine is Apple Silicon (M1/M2/M3 or later) and you will run older tools, install Rosetta with the Terminal command:softwareupdate --install-rosetta --agree-to-license
Antivirus & Antimalware
Install Homebrew first by pasting the official install command into Terminal. Then install the following:
- Task Explorer:
brew install --cask taskexplorer - KnockKnock:
brew install --cask knockknock - ClamAV: follow the full sequence of Homebrew and configuration commands to place the binaries correctly, then update definitions with
freshclam -vand scan withclamscan -r -i /.
Run Task Explorer and KnockKnock weekly. Use ClamAV for deeper scans when needed. These tools report; they do not automatically delete. Research any flagged files before removal.
Telemetry
Install a firewall application such as Little Snitch (paid) or LuLu (free). Configure it to block Apple telemetry domains and services. Strong outbound control is more important on macOS than most users realize.
System Cleaner
Use the custom scripts generated at privacy.sexy. Select the macOS privacy and security options you want, download the resulting script, and execute it weekly. Start with minimal selections until you understand each action.
VPN
Install the Proton VPN or Private Internet Access macOS client. Keep it connected for every investigative session. The same dual-provider approach used on Windows applies here.
Password Manager
Install KeePassXC. The database format is identical across platforms, so the same offline database used on Windows can be opened on macOS. Keep the master password unique and the database file offline.
Linux Host
Complete System Wipe
Boot from a Ventoy USB that contains a clean Ubuntu 22.04 (or current LTS) ISO. Install a fresh copy of the operating system. During installation disable any telemetry or diagnostic reporting options that appear. Create a local user with a strong password and keep the machine offline until basic hardening is complete.
Antivirus & Antimalware
Install ClamAV:sudo apt updatesudo apt install -y clamav clamav-daemon
Stop the service, update definitions, and restart:sudo systemctl stop clamav-freshclamsudo freshclamsudo systemctl start clamav-freshclam
Scan with clamscan -r -i / (report only) or add --remove=yes only after you have researched every hit. Run scans as needed; ClamAV is primarily useful for catching Windows malware that may arrive as email attachments or downloaded files.
Telemetry
Remove the common reporting packages:sudo apt purge -y apport apport-symptoms popularity-contest ubuntu-report whoopsiesudo apt autoremove -y
This eliminates most automatic data collection on a stock Ubuntu install.
System Cleaner
Install BleachBit:sudo apt install bleachbit
Launch the administrative version, accept the default configuration, select every option except “Free disk space,” preview, then clean. Run weekly.
VPN
Install the official Proton VPN or Private Internet Access Linux client. Connect before any investigative work and keep the tunnel active for the full session.
Password Manager
Install KeePassXC. The same offline database used on Windows or macOS works without modification. Maintain the master password and database file under the same strict offline rules.
These steps produce a clean, dedicated host ready for virtual machines and actual OSINT work. Execute them once, verify the results, and treat the finished machine as operational equipment—not a personal computer.
Leave a Reply