Anyone can search. Type a name into Google, hit enter, scroll. That's not an investigation, that's reading. Investigation starts with a question you can't answer by typing. Who owns the LLC behind the lawsuit? Which of the three people with this name is the right one? Was that photo really taken when the post claims? Did the company exist on the date the contract was signed? A search returns results. An investigation produces findings — facts you can defend, sourced and corroborated, with the gaps clearly marked. The difference shows up in four places:
Hypothesis. A searcher types what they hope to find. An investigator works on a question and lets the evidence answer. Sourcing. A searcher trusts the first result. An investigator asks where the data came from, who maintains it, and how recently it was updated. A Secretary of State filing, a court PACER record, and a Facebook bio are not the same kind of fact. Corroboration. One source is a lead. Two unrelated sources are a finding. An investigator never builds a conclusion on a single thread. Documentation. A searcher remembers what they saw. An investigator captures its URL, timestamp, archive link, screenshot with metadata — so the work survives someone trying to challenge it later.
The tools matter less than people think. Most of what I use in an OSINT engagement is publicly accessible. The skill isn't access — it's knowing which question to ask next, and when to stop because the answer is firm enough. If you're hiring someone to "look into" a person, a property, or a company, ask what they'll deliver. If the answer is "what I find," that's a search. If the answer is a documented report with sources, gaps, and confidence levels, that's an investigation.