This article is a composite scenario based on common patterns in harassment investigations. Names and details are fictionalized.

When Sarah, the owner of a boutique marketing agency, started getting direct messages from a throwaway account called @ghost_watch_99, she dismissed them as internet noise. Within three weeks, the messages had escalated to threats that referenced her daily commute, her dog’s name, and photos of her office building taken from a parked car.

She reported it to local police, who opened a file. Without a name or any legal process to identify the account holder, the case stalled. Sarah hired a licensed private investigator who specialized in open-source intelligence (OSINT) and digital forensics.

Step 1: Document everything first

Before any analysis, the investigator had Sarah preserve the evidence: full-screen captures with timestamps, message URLs, and account details, all stored in a way that could later be authenticated. She also sent a preservation request to the platform so the account data wouldn’t be deleted. Evidence that can’t be authenticated is of little use to police or a court.

Step 2: Look for patterns in the account

Anonymous accounts are often less anonymous than their owners think. The investigator looked for username variations on other public platforms and found a similar handle, minus the trailing digits, on a niche tech forum. Comparing the writing on both accounts (punctuation habits, recurring spelling errors, phrasing) suggested a common author. This kind of stylistic comparison, called stylometry, is suggestive but not conclusive. It’s a reason to investigate further, not proof.

Step 3: Analyze the photos

The stalker had posted a photo of Sarah’s office taken from across the street. Social platforms strip embedded metadata on upload, so the investigator worked from what was visible in the image:

• Shadows and sun position. Tools like SunCalc model the sun’s position at a given place and date. Matching shadow angles in the photo to those models narrowed the likely time of day to a window of about an hour.
• Reflections. A shop window in the frame showed part of a vehicle: a silver, mid-2010s sedan.
• The profile picture. A reverse image search turned up nothing, which is consistent with a generated or stolen photo but doesn’t prove it.

None of this identified anyone. It gave the investigator a profile of what to look for and a timeline to compare against other evidence.

Step 4: Hand off the attribution

The investigator stopped here on purpose. Linking a username to a real person is where the legal risk is highest. Using leaked data, probing login flows, or pulling restricted records can break the law and can taint the evidence or put a mistaken accusation on an innocent person. Good practice is to hand the leads to police and let them use legal process, such as subpoenas and warrants, to get subscriber records from platforms and carriers.

The investigator’s report included the preserved evidence with chain of custody, the username and writing comparisons, the photo analysis, and a short list of leads, each labeled as unverified. Police used it to support subpoenas to the platform. The returned records pointed to a former contractor of one of Sarah’s clients, someone whose contract had ended on bad terms. Officers interviewed him, and Sarah petitioned a court for a protective order, which was granted. The messages stopped.

What this case shows

• The investigator’s value was organizing evidence and generating leads, and the legal process did the identifying.
• Each technique here was suggestive, not conclusive. Corroboration is what makes a case.
• Stopping at the legal boundary protected both the evidence and the person who might have been wrongly accused.

Key takeaways for digital safety

Username reuse

• How it’s exploited: Linking anonymous accounts to personal profiles.
• Defensive action: Use unique handles for sensitive accounts.

Location leakage

• How it’s exploited: Background landmarks and real-time posting reveal routines.
• Defensive action: Post photos after you’ve left, and check backgrounds for street signs and landmarks.

Old data breaches

• How it’s exploited: Leaked emails and phone numbers tie accounts together.
• Defensive action: Use separate emails or aliases per service, enable two-factor authentication, and check your exposure on a breach-notification site.

Public records and data brokers

• How it’s exploited: Home addresses and vehicle details are easy to look up.
• Defensive action: Opt out of data-broker sites and use privacy options on public records where available.

If you’re being harassed

1. Don’t engage. Replies often escalate things.
2. Document everything. Keep screenshots, links, dates, and times, and save the originals.
3. Report it to the platform and to local police, and ask for a case number.
4. Consider a lawyer or licensed investigator to help with preservation requests and protective orders.
5. Don’t try to identify the person yourself. Misidentification and legal exposure are real risks, and the legal process is better at getting solid answers.