Trace Labs OSINT VM
Debian-based virtual machine purpose-built for OSINT investigations
Trace Labs OSINT VM has no official, structured tool listing we can auto-sync (unlike Kali, BlackArch, REMnux, and Tails). The tools below are maintained by hand and may be incomplete or outdated — check the official docs for the current tool set.
Last verified September 5, 2026
Trace Labs OSINT VM is maintained by the nonprofit behind the Trace Labs Search Party CTF — crowdsourced open-source-intelligence gathering used to help locate missing persons — and bundles OSINT tooling for domain, email, phone-number, username, and social-media reconnaissance.
Use it only against people/organizations you own or are explicitly authorized to investigate — see the disclaimer.
Notable bundled toolsmanually maintained
maltego
Open source intelligence and forensics application
phoneinfoga
Information gathering & OSINT framework for phone numbers.
sherlock
Find usernames across social networks
sn0int
Semi-automatic OSINT framework and package manager
spiderfoot
OSINT collection and reconnaissance tool
theharvester
Tool for gathering e-mail accounts and subdomain names from public sources
Getting started
The 2026.07 release ships as prebuilt VirtualBox/VMware OVA images and an ARM64 qcow2 image, with a choice of XFCE or GNOME desktops (default login `osint`/`osint`). Its tools can also be layered onto an existing Kali or Debian install via the standalone `tlosint-tools.sh` script instead of importing the full VM. As of the 2026.05 release it was rebuilt from scratch on Debian rather than Kali, specifically to drop red-team/exploit tooling and focus purely on OSINT.