Facebook is still the largest, deepest, and most embarrassing public archive of human behavior ever assembled. It's also the platform OSINT operators keep being told is "dead." Both things are true at the same time.
What died in 2019 was Graph Search — Facebook's natural-language query engine that let investigators ask "photos of [person] taken in [city] in [year]" and get answers. Vice broke the story when Facebook quietly killed it, and OSINT trainer Michael Bazzell called it "one of the most devastating weeks towards online investigations" in his twenty-year career.
What didn't die: three billion users, a decade of check-ins, the Marketplace, the Ad Library, and the ability for anyone with the right URL pattern to pull data Meta hopes you forgot about.
This is the working SOCMINT playbook for Facebook — what still works, what's quietly gone, and which tools you actually need open in tabs.
The numeric ID is the master key
Every Facebook profile, page, and group has a numeric ID. The vanity URL (/zuck) is decoration. The fifteen-digit number is the database key — and almost every advanced trick depends on it.
Three reliable ways to extract it:
- Paste the profile URL into lookup-id.com and read the number off the page.
- Use findmyfbid as a fallback. These services rotate domains constantly — bookmark two, never one.
- The manual method that always works: open the profile, view source, search for userID or profile_id. The number is right there. Forensic OSINT documents the exact procedure.
Once you have the ID, you can construct URLs Facebook never advertises — photos uploaded, friends visible to friends, places tagged, ad activity. All of it is gated behind one number.
URL pattern crafting — what's left of Graph Search
Graph Search is gone. The endpoints it used aren't entirely. Investigators have spent six years reverse-engineering which /search/ paths still resolve and which 404 quietly. The current state of play: most "people who like X" queries are dead, but combined-attribute searches over public posts, places, and pages still partially work if you craft the URL by hand.
Don't memorize the syntax. Use a builder.
- Sowdust's Facebook search builder generates the URLs for you and updates as Meta breaks paths. Every working investigator has it bookmarked.
- IntelligenceX Facebook tools, including WhoPostedWhat, cover keyword-on-timeline searches and date-range filters the native UI refuses to expose.
- Plain Google with site:facebook.com plus your keyword still surfaces public posts the in-app search hides. It's crude. It works.
StalkScan, Graph.tips, and ExtractFace are all in the graveyard. If a tutorial from 2018 tells you to use them, the tutorial is from 2018.
The Ad Library is the most underused asset on Facebook
The Meta Ad Library is a public, searchable archive of every active ad on Facebook and Instagram. Political and social-issue ads stay for seven years and include spend ranges, reach buckets, and the funding entity behind them. This is fully indexed, fully open, and almost nobody uses it for non-political work.
Why it matters: companies, scammers, and influence operations all have to advertise eventually. The Library captures the creative, the page running it, and the geography it targets. GIJN's guide to digital ad libraries walks through tracing ad networks across pages — including the disclosure gap exploited by ads that ran without disclaimers, more than $62 million worth between May 2018 and October 2020 alone.
If your subject runs a business, has ever boosted a post, or sits in a network of related pages, the Ad Library will tell you more in five minutes than the profile will in an hour.
CrowdTangle is dead. Plan accordingly.
For a decade, CrowdTangle was the closest thing journalists had to a real-time monitor for Facebook. Meta shut it down on August 14, 2024. The replacement — Meta Content Library — is locked behind academic IRB approval, with institutional sign-off and applications routed through ICPSR at the University of Michigan. One CEO put it bluntly: the new tool has "1% of the features." That's not hyperbole.
Practical fallback: scrape the public-facing data Meta still exposes (pages, groups, Ad Library), use Wayback snapshots to recover deleted posts, and accept that real-time disinformation tracking on Facebook is now a slower, worse version of itself. Anyone telling you otherwise is selling a course.
Photos, faces, and reverse search
The profile picture is usually the only image you can grab without being friends. That's enough.
The standard pipeline: download the photo, run it through Yandex Images for the broadest reverse hits on Russian, Eastern European, and obscure Asian sites, then through PimEyes for actual face-recognition matches across the open web. Yandex finds the same image republished. PimEyes finds the same face on a different image — a categorically different capability.
The combination beats Google Images by an embarrassing margin. If Google is still your primary reverse search, you're missing the majority of what's findable.
Groups, events, places, Marketplace
The native Facebook UI hides four data sources that remain wide open if you know where to look.
Groups. Public group membership and posts are searchable. Mutual-friend probing inside semi-private groups still leaks metadata even when content is locked. Groups are where targets actually talk; profiles are where they perform.
Events. Past attendance lists, host pages, and event-photo tagging persist long after the event itself. Events are the single best way to pivot from a person to their physical-world social graph.
Places and check-ins. Tagged places remain a strong geolocation signal years after the original post. fb-sleep-stats can infer sleep and activity patterns from public reaction timestamps if the target leaves reactions visible.
Marketplace. Forensic OSINT calls Marketplace a "research goldmine" — and they're not wrong. Listings carry neighborhood-precise location pins, photos with reflections and background detail, and seller profiles you can pivot to. Recent techniques even let investigators identify the seller behind a Marketplace post without logging in, via source-code analysis. If a target has ever sold a couch, you have their approximate home address.
Recovering what's been deleted
Facebook is not a graveyard. The Wayback Machine is. Most public profile pages have partial snapshots. Combine that with archive.today and the residual Google cache, and you can often reconstruct a post the subject deleted three years ago, thinking nobody saw it. They were wrong.
The workflow: paste the public profile URL into web.archive.org, walk the calendar, expand each snapshot. Don't assume the most recent capture is the most useful — the gold is usually in a snapshot from a year the subject forgot existed.
Channels worth following
Facebook's surface changes monthly. The investigators who stay current publish their findings publicly:
- Henk van Ess — the most consistent source of working Facebook tricks; @henkvaness on X.
- Bellingcat and their online investigations toolkit for documented case methodology.
- Operators worth a follow on X and Telegram: @osint_tactical, @cyb_detective, @osintcurious, @intelschool, @i_am_osint. They post URL syntax updates within hours of Meta breaking something.
The reality check
Facebook SOCMINT today is not what it was in 2017. Graph Search is dead, CrowdTangle is dead, StalkScan is dead, Graph.tips is dead. Each shutdown moved real investigative capability from "trivial" to "specialist."
What replaced them is a layered toolkit: the numeric ID as the key, manual URL crafting where graph queries used to live, the Ad Library for everything ad-adjacent, Marketplace and check-ins for geolocation, a Yandex-plus-PimEyes stack for photos, and the Wayback Machine for everything Meta hopes you can no longer see.
Anyone who tells you Facebook is "useless for OSINT" hasn't opened the Ad Library this year. Anyone who tells you it's easy is selling a course. The actual answer is the same as it's always been: the right tools, awareness of which ones are quietly broken this week, and the willingness to do the work.