Searchlight — IMINT
Searchlight — IMINT — a TryHackMe room focused on IMINT and GEOINT. This write-up provides the full walkthrough of the room with answers. The write-up is published for practice purposes. Beginner OSINT analysts: do not use this cheat sheet to complete the room instead of doing it yourself.
Stage — 1
Task 2 was to establish the street where the photograph was taken. The tool used for this task was Google Lens, i.e. a reverse image search. The image shows the inscription “Welcome to Carnaby Street” and the name of a store, Fornorino. A reverse image search with Google Lens returned a similar image, which established the name of the street: Carnaby Street.
Stage — 2
Task 3, titled “Just google it”, contained four questions. The first question was to establish the city where the metro station shown in the image is located. All subsequent questions in Task 3 relate to this station.
The image shows the sign “public subway underground public subway”. A Google Dorking search for this text returned no results, so a Google Lens reverse image search was used instead. It returned a Wikipedia page showing the same station, which provided all the answers: the city is “London”, these stairs lead to the “Piccadilly Circus” station, it opened in “1906”, and it has “4” platforms.
Stage — 3
Task 4 started with a single photograph of a building as the only source material. From it, the following had to be established: which building the photo was taken at, which country it is in, and which city it is in. The tools used were Google, Google Lens and Google Dorking.
The image shows a sign reading “YVR” and the domain “YVR.ca”. A Google Dork search for “YVR” established that this is “Vancouver International Airport”, located in “Canada” in the city of “Richmond”. Tasks 1, 2 and 3 were closed.
Stage — 4
Task 5. The source material was a photograph of a café. The task was to establish the following from it: 1. Which city is this coffee shop located in? 2. Which street is this coffee shop located in? 3. What is their phone number? 4. What is their email address? 5. What is the surname of the owners? Tools used: Google Dorks, a reverse image search via Google Lens, and a regular Google search.
A reverse image search identified the city — “Blairgowrie”. The street, “Allan Street”, is visible in the photograph itself. A deeper analysis established the email address “theweecoffeeshop@aol.com” and the phone number “+44 7878 839128”. Tasks 1, 2, 3 and 4 were closed.
The fifth and final question — the surname of the café’s owners — was answered from customer reviews on tripadvisor.ie. A review on the café’s page, dated 27 January 2024, named two people: David and Debbie. These may be the first names of the owners. A Google Dork search for “Debbie” “David” “The Wee Coffee Shop” returned a website with a map of the cafés; the “Operator” field on that site lists the surname “Cochrane”. Tasks 1, 2, 3, 4 and 5 were closed, completing the stage in the same way as the previous ones.
Stage — 5
Task 6. The source material was a photograph taken inside a closed room — a restaurant. The task was to establish: 1. Which restaurant this photograph was taken in. 2. The name of the Bon Appétit editor who spent 24 hours in this restaurant. Tools used: the RevEye extension for a reverse image search, and Google Dorking.
A reverse image search was run using the RevEye extension in Bing. The results matched a restaurant in New York: “Katz’s Deli”, also known as “Katz’s Delicatessen”. The name is stated as established by a single search engine query; under the two-source rule it remains a working identification until corroborated by an independent source, such as the restaurant’s own website or a public register entry. Task 1 was closed.
Get xxx’s stories in your inbox
Join Medium for free to get updates from this writer.
Question 2 asked for the name of the Bon Appétit editor who worked 24 hours at the restaurant. A Bing dork led to an article dated 24 October 2017, in which the name “Andrew Knowlton” was mentioned. The answer was submitted to TryHackMe and accepted as correct, which confirms the identification for the purposes of this task; the article remains the only cited source. Both questions in Task 6 were closed.
Stage — 6
Task 7. The source material was a single photograph of a sculpture. In the background of the image were houses, leaves, benches and other objects. The task was to establish two things: 1. What is the name of this statue? 2. Who took this image? Both questions are stated in the challenge as given; the answers are not derivable from the photograph alone, so the identification depends on the search results rather than on the visible features of the frame. Tools used: Google Dorks, a reverse image search, and the RevEye extension.
A reverse image search was run using the RevEye extension. The results led to a publication on tripadvisor.com, posted in March 2024 by a user with the username “Cruiser29012093048”, which contained the original image of the sculpture. The sculpture was identified as “Rudolph the Chrome Nosed Reindeer”, located in “Tjuvholmen Sculpture Park”. Both names rest on a single user publication; under the two-source rule they remain a working identification until corroborated by an independent source, such as the park’s entry in a municipal or public-art register.
A reverse image search led to https://www.visitoslo.com/articles/outdoor-sculptures-in-oslo, which hosts a map of outdoor sculptures in Oslo. The name “Rudolph the Chrome Nosed Reindeer” was entered in the page’s listing; the entry gave the sculptor’s full name as “Kjersti Stensrud”. The answer was submitted to TryHackMe and accepted as correct, which confirms the attribution for the purposes of this task; the Visit Oslo page remains the only cited source, so the attribution is treated as a working identification rather than a fact under the two-source rule. Questions 1 and 2 in Task 7 were closed.
Stage — 7
Task 8. The source material was a single photograph of a statue of a person wearing a headscarf. The task was to establish three things: 1. What is the name of the character that the statue depicts? 2. Where is this statue located? 3. What is the name of the building opposite from this statue? All three questions concern the same site, so the answers were expected to follow from a single identification rather than from three separate searches. The third question, in particular, cannot be answered from the photograph alone and depends on the location being fixed first. Tools used: Google Dorks, the RevEye extension, and a reverse image search.
A reverse image search was run in Bing. The results led to the Wikipedia page https://en.wikipedia.org/wiki/Lady_Justice. Analysis of the page identified the character depicted by the statue as “Lady Justice”, the personification of justice commonly shown blindfolded and holding scales. The answer was submitted to TryHackMe and accepted as correct, which confirms the identification for the purposes of this task; Wikipedia is a secondary source, so the identification is treated as a working one rather than a fact under the two-source rule. Question 1 was closed.
Analysis of the reverse image search results also established the location of the statue. An article on americanprogress carried the line: “A a statue of blind justice is seen outside the Albert V. Bryan U.S. Courthouse in Alexandria, Virginia, September 2016.” The phrase identifies the building opposite the statue as the Albert V. Bryan U.S. Courthouse and places it in Alexandria, Virginia. The location was submitted to TryHackMe and accepted as correct. Question 2 of Task 8 was closed; the source link was not included in the original notes and will be added to the americanprogress reference.
A Google Maps search for “Albert V. Bryan U.S. Courthouse” was run to answer the third question — the name of the building opposite the statue. The map placed a hotel directly across from the courthouse: “The Westin Alexandria Old Town”. The answer was submitted to TryHackMe and accepted as correct, which closes the question for the purposes of this task. The identification rests on a single mapping service; under the two-source rule it remains a working one, and a second source — the hotel’s own listing or an independent photograph of the site — would be needed to treat it as a fact. Question 3 of Task 8 was closed, completing the task.
Stage — 8
Task 9. The source material was a video rather than a photograph, which meant the geolocation had to be carried out from moving footage: a video offers many more frames to work with, but each frame carries less detail than a still image, and the identifying features may only appear briefly. The task was to establish: 1. What is the name of the hotel that my friend stayed in a few years ago? The question is quoted from the challenge as written, including the first-person phrasing. Tools used: Google Lens and Google Dorks.
The initial identification attempt failed. A Google Lens pass against the video returned no exact match; more than 10 candidate results were reviewed and none could be tied to the frame with confidence. A second attempt was made using Google Dorks with a still frame extracted from the video as the query. That search returned a large number of results, which were checked individually. The review produced a match: “Novotel Singapore Clarke Quay”. The name is corroborated by two independent articles about the hotel and by the answer accepted on TryHackMe; under the two-source rule this is sufficient to treat the identification as established rather than as a working hypothesis. Task 9 was closed.
End
The write-up is now complete. The work — writing, formatting and gathering the source material — took the team 5 hours. The information presented here was collected from open sources only; every identification was checked against TryHackMe, and where the two-source rule could not be met, the result is marked as a working identification rather than a fact. Thanks to everyone who read this write-up and left a like. Good luck with your training.
