Step-by-step workflow guide for investigators
Digital Footprint Mapping
Who is this for?
The trigger to use this workflow is having an alias of the person of interest and needing to discover what other platforms, accounts, and identifiers are connected to that person.
What is on this page?
How to use this page?
The workflow is designed to be completed in under 15 minutes. Have the username of the account you're assessing ready before you begin.
Please note that the data returned by Graph is always live, and the results in the video demonstration might not be reproducible at a later time if they disappeared from the public domain.
New to Graph?
A note on results
Data providers used on this page
Before you start:
Identify the starting point
Alias of the account you are assessing.
You can also use this workflow starting with an email address. Repeat the same steps as for the alias.
Note: The more unique the username, the higher quality your results will be. Normal text.
Access
- Download and install Graph (Desktop).
- Install the Person of Interest Data Pass modules from the Data Hub within Graph (Desktop).
Note: Basic users have limited access to the data providers used in this workflow more generally — some transforms may be unavailable or return restricted results depending on your plan tier.
Resources
This guide assumes basic familiarity with Graph (Desktop). Feature names link to the documentation where needed. It helps to have the following pages open before you start:
If you have not identified a specific account to assess for threats, consider setting up a VIP protection , event monitoring, or brand reputation monitors first to see the actors posting violent or threatening content in relation to a person or an event.
Video Overview
Watch a digital footprint mapping workflow demonstration. Then follow the step-by-step guide below to build your own, or skip the video and jump straight to the steps.
To enlarge, double-click on the video.
Step-by-Step Guide
Step 1: Run a comprehensive social media search
- Add the Alias Entity to the graph.
- Open the Transform menu by right-clicking on the Entity.
- Navigate to Person of Interest → Comprehensive Search.
- Select and run: [POI] - Search Profiles [OSINT Industries].
OSINT Industries searches across a wide range of platforms in a single run, giving you the broadest possible initial coverage. Pipl is also available in the Person of Interest data pass as an alternative if you want to run a second broad search.
- Platform icon
- Username: The alias on that platform.
- Given name: If the user provided one on their profile (treat with caution, as it can be easily faked). Look for consistency across multiple platforms before treating a name as credible.
- Alternate usernames: Some profiles may show additional handles the user goes by.
If an alternate alias is a common or generic string, the search will return profiles belonging to multiple unrelated people. If you see names and profiles that clearly don't match your subject, treat the results with caution and don't incorporate them into your findings without additional corroboration.
Step 2: Look for breach data
How to:
- Open the Transform menu by right-clicking on the Entity.
- Run Comprehensive Search → Leaked Records Search (alias).
- Once breach results appear, select the Compromised Records Entities on your graph. Right-click and run Extract all personally identifiable information to pull structured data out of those records.
What you can find
- Deleted accounts: Platforms where the username existed but has since been removed.
- Email addresses: Associated emails that aren't publicly displayed on profiles.
- Additional platforms: Accounts on platforms you didn't find in the first search (e.g., Telegram, GitHub).
- Consistency check: Cross-reference names and identifiers to confirm you're tracking one person, not multiple users with the same handle.
Step 3: Expand your search using discovered email addresses
Email addresses discovered in Steps 1 and 2 can unlock additional profiles that don't use the same username. Repeat steps 1 and 2 on these emails to ensure you haven't missed accounts where the person uses a different alias.
Why search emails?
Many people use different usernames across platforms but register all accounts with the same email address. Searching emails ensures you capture accounts where the person doesn't use their primary alias, giving you a more complete footprint.
Which emails to search?
Avoid email addresses that appear to be disposable or temporary. Examples could include Temp Mail, 10MinuteMail, Guerilla Mail, Proton.
If an email address shares the same username pattern as the original alias, treat that as a strong signal that the associated social media account belongs to the same person.
- Select one or more Email Address Entities on your graph.
- Right-click and navigate to the Person of Interest data pass.
- Run [POI] - Search Profiles [OSINT Industries].
- Alternatively, Epieos is available as a second option for email-based profile searches if you want to cross-check results from a different provider: Search Social Media Profiles [Epieos]
What you will find:
Results from email-based searches often overlap with what you've already found confirming links between the email address and known accounts but may also surface new profiles or additional hits on alternate aliases.
Any alternate alias discovered during the workflow — whether through the initial search or from breach data — should be treated as a new starting point and searched independently.
When to stop?
Stop when:
- You've exhausted the direct identifiers (username + discovered emails).
- New results are not yielding additional unique platforms or identities.
- You've consumed your budgeted credits for this investigation.
- You have sufficient coverage for your investigation goal.
What's next?
-
If your goal is to map the online presence of an alias identity, you're done after this workflow.
-
Set up a Threat Actor monitor for tracking the person's social media feed for threatening posts.
-
Check out the guide for Maltego Evidence for collecting and preserving social media posts from the person's of interest account before it disappears,
Other guides you might find useful:
Give us your Feedback!
Copyright © 2026
