By Cynthia Hetherington

Do you have laser-like focus? Are you effective in communicating with clients? Diving deep to find the needle in that haystack? Able to absorb volumes of information, discern the facts, and write them in an orderly fashion? Does the old adage, “God gave us one mouth and two ears” speak to you? These are all traits required of a successful investigator. Before you set to work on any cyber investigation, you may need to learn how to CRAWL: Communicate, Research, Analyze, Write, and Listen.

CRAWL allows investigators to implement a foundational approach for receiving new projects, reporting their findings, and transcending their competitors in customer-service response. Good investigators say that research is the most important step. Successful investigators say that analysis and good report writing can be very profitable. Great investigators know it is all in communicating with their clients, with an emphasis on listening. A solid investigator who is profitable, well-respected, and seeking steady work needs all five components.

Veteran investigators know that there are specialists in certain fields of research. Some fields of specialization are arson, surveillance, business backgrounds, organized crime, matrimonial, defense, and legal. As varied as these fields are, these experts all utilize the fundamentals of CRAWLing. CRAWLing demands skills beyond the investigator’s specialization.

CRAWLing is the business model for investigators, just as the scientific method is a constant for scientists.

Without a fundamental application of the principles of CRAWL, an investigator may have a short career, because she or he will not see return business, will become frustrated over inconsistent reports, and will not understand why the phone is not ringing. In this 6-part blog series, I will teach newbies how to CRAWL and help seasoned investigators refine their skills. Last week, in Part 1, we discussed how to communicate effectively and sincerely. This week, we explore the logistics of communicating.

What is the Big Picture? Establishing Criteria and Expectations

Find out what the client wants. Examine what outcome she is seeking. Talk to clients in a professional yet sincere manner to understand the final goal. A key question to always ask during the initial interview with the client is “What outcome are you expecting from my investigation?”

Do not promise a particular outcome; it may not be obtainable or legal. I always explain to my clients that “I will do my best to support their position but there are no guarantees.” In either event, I will report my findings.


Establish goals for the following:

  • Report style
  • Budget
  • Time constraints

“How quickly can you get it done, and what is it going to cost me?” are generally the first questions you get from a client. But your final product development should be based on “affordable, complete, and time sensitive.” Some clients have ongoing cases that can take months or even years, and turnaround time is not the major factor. These longer engagements allow for expert work within decent budgets. Still, these long-term projects should be set up with short-term goals.

When working with the client, establish expectations for short-, mid- and long-term goals. For example, your short-term reporting may consist of interviews and some database research. The client is informed that she will get a call and subsequent update by email within a few weeks. The mid-term goals may be for on-site records collection and deeper research needs.

Communicate to your client that your investigation may take several days to several months, depending on the records needed and the scope of the investigation. Inform the client that a final, in-depth report will be delivered and offer a realistic time-frame for delivery, which could be a month or longer from your original sit-down engagement.

Informing the client of your time constraints in advance and putting this in your letter of engagement from the outset will help keep you motivated and on schedule as well as establish benchmarks in the investigation for you and the client. Any time there is a problem in retrieving information that affects your time budget, inform the client immediately.

Mini Case Study

Conduct a preemployment background check on a retired military professional. Immediately, you can inform the client on your validations of certain information such as a check of the Social Security Number and current address. Perhaps in a week or so you can report on any criminal records as well as courthouse filings (litigation, judgments, etc.) you have uncovered. Finally, your client needs to understand that military records themselves can take several months to obtain from the government agency.


Similar to time, it is important to inform the client about the costs of the investigation. When preparing a budget consider and include the following:

  • If you are working at an hourly rate, does it include database fees and vendors? If not, make sure the client knows he is paying your hourly rate plus these additional research fees.
  • Inform the client if you are working with several rates. For example, investigators may work at $200 per hour, while an attorney will be reviewing the folio at a rate of $450 per hour.
  • Itemize the financial costs in the letter of engagement.

It takes some experience to understand how many hours it will take to conduct a particular investigation. Even with a best guesstimate, some cases that seem easy and direct at the onset often tum into long-winded investigations no one could have predicted. As with the time budget, if you see your case is going to exceed the budget, inform your client prior to continuing, Even the best results will be met with criticism when the final invoice arrives at twice the price.

It is also possible to set a per-project price approach, instead of working at an hourly rate. This can be very successful for repetitive work. A per-project price allows your client to budget for their case needs. A good example is pre-employment checks. Most costs are known ahead of time, so most pre-employment searches come in at the same price every time. Domestic due diligence on small companies is also relatively predictable and can be quoted in one lump sum.

What are Your Deliverables?

Does the client want a formal report that can be submitted to management or is court-ready deposition required? The latter tend to be reviewed by a peer investigator or an attorney before being submitted. An informal report will give the client the details of request, without the hours and budget spent on formalities or a review by counsel.

Present the final report style as originally agreed upon. It may be delivered via email, fax, face-to-face, or on a Zoom or phone call. Whether by video or phone, it is important to record the details of this conversation for your records. In the case of a phone call or an informal report, always follow-up with a fax or email restating your findings, then file it in your case file.

Be sure to check back next week, when I discuss Research!


Are you an analyst or investigator looking for introductory training on conducting OSINT investigations? If so, check out Hg’s August special webinar training package: Online Social Media Primer Series.  This introductory primer series will teach you why to use these platforms, how to get into them, where to look, what nuances and leads you need to chase down, and how they are all interrelated. We’ll also discuss how to capture content per service, so you can present it in your reports.


With over twenty-five years of global experience in open source investigations and one of the first investigative firms to conduct online social media investigations, Hetherington Group develops advanced cyber investigations unique to your needs. Learn how Hg’s analysts can clear through jargon and uncover answers buried deep in open sources, social media pages, and Dark Web sites.


Cynthia Hetherington, MLS, MSM, CFE, CII is the founder and president of Hetherington Group, a consulting, publishing, and training firm that leads in due diligence, corporate intelligence, and cyber investigations by keeping pace with the latest security threats and assessments. She has authored three books on how to conduct investigations, is the publisher of the newsletter, Data2know: Internet and Online Intelligence, and annually trains thousands of investigators, security professionals, attorneys, accountants, auditors, military intelligence professionals, and federal, state, and local agencies on best practices in the public and private sectors.