Finding the Person Behind the Profile

In a recent litigation matter, an attorney came to us with an interesting problem. A group of people had been posting videos to social media showing themselves vandalizing a property in California. He had the accounts. He didn’t have the names.

That’s a real problem. You can’t sue a username. You can’t serve @NotMyRealName_Kevin. And if you name the wrong person, you’ve just created a bigger problem than the one you started with.

So the job was to figure out who these people actually were.

A social media username might seem like very little to start with, but you’d be surprised how much you can uncover if you know where to look and, more importantly, how to follow the clues.

Finding people is right up my alley. I’ve told more than one person that if my only job were tracking down people for the rest of my life, I’d be a happy man. There’s something about the hunt—following the breadcrumbs, making connections, chasing down leads, and getting that little win when you uncover something that puts you one step closer.

Sometimes it’s ridiculously easy. Someone uses their real name or a variation of it as their username. You find a location, run some database searches, and within a few minutes you’ve got a pretty good idea of who you’re dealing with.

But sometimes you get the tough ones; you have no real name, no location, no employer, and no obvious family members—just a strange username and a nearly empty profile.

That’s when things get interesting. At that point, finding someone is less about having access to a special database and more about knowing how to follow the clues.

You’re Looking for Pivot Points

The obvious place to start is the person’s profile, but I’m not just looking at what they posted. I’m looking at everything around it. Who are they tagging? Who’s tagging them? Who comments regularly? Are there family members? Birthday wishes? Schools? Sports teams? Locations? Cars? License plates? Businesses in the background of their photos?

All of these can serve as pivot points.

Rarely does one clue suddenly tell you, “This is the person.” Instead, one clue leads you somewhere else. That leads to another clue, which leads somewhere else.

A few of the people from this case are great examples.

(Names, usernames, and identifying details have been changed.)

@NotMyRealName_Kevin: Same Username, Different Platform

First there was @NotMyRealName_Kevin.

I know. Fun.

His Instagram page was bare. Nothing there was going to help. But you know what people love to do? Use the same username across multiple platforms.

So we looked elsewhere, and sure enough, the same username turned up on X. Kevin had been careful about what he put on Instagram. His X account was a different story. Suddenly, there was another trail to follow.

A simple lesson, but an important one: we weren’t investigating an Instagram profile. We were investigating a person. Instagram is one window into that person’s online life. If that window is closed, look for another one.

@JerseyGary1976: The Profile Was Bare. His Activity Wasn’t.

Then there was @JerseyGary1976.

Gary’s Facebook profile was also bare, but using ShadowDragon, one of our investigative tools, we identified activity in several Facebook groups devoted to trading cards.

Following that thread, we found Gary selling cards through Facebook Marketplace. In an exchange with a potential buyer, he’d handed over an email address.

There was the next pivot.

Empty profile to trading card groups. Groups to Marketplace. Marketplace to an email address that opened up an entirely new line of research.

The profile didn’t tell us much about Gary. His activity did.

@TruthHammer42: When the Public Profile Gives You Nothing

Then there was @TruthHammer42, whose Facebook profile was equally unhelpful. This time, not even ShadowDragon was turning up anything useful.

So we changed where we were looking. Using Darkside by District 4, we found that the Facebook account appeared in data connected to a breach from several years earlier.

And bingo: an email address.

That email address became the next pivot. It led to other online profiles tied to the same identifier. Those profiles gave us more to corroborate and ultimately led us to the person behind @TruthHammer42.

Again, the first clue didn’t give us the answer. It gave us somewhere else to look.

@run_dmc_dan: The Motorcycle That Wasn’t His

One of my favorites was @run_dmc_dan.

Looking through the people around Dan on Instagram, we found a post of one of his friends pictured riding a motorcycle. Based on the context, we suspected the bike might actually be Dan’s, and a registration number was visible in the photo.

So we ran it. It came back registered to someone with a completely different name.

That could have been the end of the lead. Instead, we looked into the registered owner and found that he had a son named Dan.

Now things were getting interesting.

We Googled the son’s name and found photos of him. He was a nearly identical physical match to the person we’d been looking for on Instagram. But we also found something else: a biography in which he referred to his love of motocross.

Now, think about how we got there. We started with a photo on a friend’s Instagram account of a motorcycle that we thought might belong to Dan. The registration came back to someone with the “wrong” name. That name led us to a son named Dan. Dan looked like our guy. And then we found independent evidence connecting him directly to motorcycles.

None of those pieces alone was enough. But when you put them together, they told a much more convincing story.

A dead end isn’t always a dead end. Sometimes it’s just another pivot.

Todd Wilson and the Birthday That Didn’t Exist

Then there was Todd Wilson.

We had his name, but Todd Wilson isn’t exactly uncommon. Buried deep in his Instagram account, though, were several people wishing him a happy birthday on March 1.

Great. A name, a general location, and a birthday. This should have been easy.

Except it wasn’t.

We ran Todd Wilson with a March 1 birthday through database after database and came up empty-handed. Different searches, different sources, same result. Nothing.

Something wasn’t adding up.

That’s when one of our investigators had a thought. What if March 1 wasn’t Todd’s actual birthday? What if his friends were wishing him a happy birthday that day because his real birthday didn’t happen every year?

We tried February 29.

There he was.

Todd was a leap-year baby.

It seems obvious once you know the answer. It wasn’t obvious as we stared at searches that kept coming up empty. It’s also a perfect example of why this work isn’t simply about having access to the right tools.

Sometimes you need to question what you think you know.

Social Media Clues Aren’t Facts

Todd’s story highlights something important: Social media clues aren’t facts.

People post birthday messages late. They use nicknames. They tag the place they’re visiting instead of where they live. They repost old photos. They make jokes that make no sense to anyone outside their circle.

If someone wishes Todd Wilson a happy birthday on March 1, that’s a clue suggesting something about Todd’s birthday. It’s not the same as a record saying Todd was born on March 1.

That’s why corroboration matters. And in this case, it mattered a great deal.

Getting It Right Was the Whole Job

Remember where this started: an attorney with five social media accounts, no names, and a case that couldn’t move until real people were attached to those handles.

This meant that “This probably is the guy” was worth nothing to him.

An identification in litigation has to withstand attack. Opposing counsel is going to ask how you got there, and a person who merely looks like the right person isn’t enough. I won’t put a name in a report until multiple independent pieces of information point in the same direction: name, age, geography, relatives, social connections, and timeline. We want them to make sense together. We look for anything that contradicts the theory.

That’s why Dan is the example I’d walk an attorney through. A motorcycle registered to a man with a son named Dan wasn’t enough by itself. But finding a Dan who looked nearly identical and loved motocross was much more interesting. Now there were two independent pieces of information coming from different sources, both pointing to the same person.

Todd is the same story from the other side. A birthday wish on Instagram is a clue. A database record showing a February 29th birth date is evidence.  

The fun part of this work is the hunt. 

The Best Investigative Tool Isn’t Always a Database

People assume investigators have some magical database where we type in @NotMyRealName_Kevin and click a button, and his name, address, phone number, and entire life pop onto the screen.

It doesn’t work that way.

Don’t get me wrong. We have access to some incredibly powerful tools and data sources, and they’re an important part of the work. But a tool doesn’t tell you what question to ask next.

It doesn’t tell you that Kevin might have used the same username on X. It doesn’t tell you that Gary’s interest in trading cards could lead somewhere useful. It doesn’t tell you that a motorcycle registered to a different person might be the clue you need.

And it certainly doesn’t tell you that March 1 might mean February 29.

No tool does that. That comes from years of doing this and knowing when something smells wrong.

It’s All About the Next Pivot

Here’s the part I still find remarkable. Every example in this article came from the same case—five people, five profiles, five completely different paths to a name.

A username led to another platform. A hobby led to a Marketplace post. An old identifier led to another profile. A friend’s photo led to a motorcycle registration. A pile of birthday wishes led to a date that didn’t quite make sense.

No playbook says, “If Instagram doesn’t work, do this next.” Every investigation takes its own path. You follow a breadcrumb and chase a lead. Sometimes it goes nowhere. Sometimes it hands you another breadcrumb. And every once in a while, you find the one piece that makes everything else fall into place.

After years of doing this, I’ve found that the most interesting cases aren’t the ones where a database gives you an answer in 30 seconds.

They’re the ones where it doesn’t.

The ones where you follow the breadcrumbs, question your assumptions, and keep asking yourself, “Where does this clue take me next?”

The tools change. The clues change. The path changes.

The process rarely does.

That’s the hunt. And frankly, it’s why I love this work.