Disclaimer: This article is for education and for lawful, authorised professional research. Use these methods only where you have a legitimate purpose and a lawful basis, and follow the laws and platform terms that apply to you, including data protection law such as the UK GDPR and EU GDPR. See our Terms of Service.
TL;DR
- In YouTube OSINT, start with the channel ID: every YouTube channel has a permanent channel ID beginning
UC. Handles, names and banners change; the ID does not. Cite it. - The "published" date is when a video went public, not when it was filmed or uploaded. The YouTube Data API gives exact UTC times and needs a free API key.
- Thumbnails and keyframes are the fastest route to the original source of recycled footage. InVID-WeVerify still does this well; Amnesty's YouTube DataViewer is no longer online.
- Geolocation from landmarks, signage and shadows confirms where footage was filmed. Keep the method on places and events, not people.
- UserSearch helps you pivot from a channel's handle, website and images to other sources, with results kept in one auditable Case.
Why Does YouTube Footage Need Checking Before It Is Trusted?
YouTube OSINT is the use of public YouTube channels, videos, metadata and comments to verify footage and attribute channels, anchored to permanent channel IDs and exact API timestamps. A video of a burning warehouse lands in the newsroom chat. It has 400,000 views, a caption saying it was filmed an hour ago in a city you cover, and a channel name that sounds like a local news service. The pressure is to use it now. The risk is that it is three years old, from another country, and posted by a channel that renamed itself last week to borrow a local outlet's credibility.
YouTube is one of the richest sources of eyewitness footage and one of the easiest places to recycle it. The platform keeps plenty of evidence about a channel and a video, but most of it sits a layer below the watch page. This guide covers the method we use: fix the channel's permanent identity, establish exact publication times, pull thumbnails and keyframes for reverse image search, read the comments for leads, and confirm where the footage was filmed from the landmarks in the frame.
What Is YouTube OSINT and What Does YouTube Actually Record?
YouTube OSINT is the use of public YouTube material (channels, videos, metadata, comments) to answer a verification or attribution question. The concept that makes it work is the difference between a channel's labels and its identifier.
- Channel ID: a 24-character string beginning
UC, visible in URLs of the formyoutube.com/channel/UC.... It is assigned at creation and never changes. - Handle: the
@nameintroduced in 2022. YouTube's help page on handles explains that each channel has one unique handle of 3 to 30 characters, that the handle becomes the channel URL, and that legacy personalised URLs keep working. Handles can be changed. - Legacy URLs: older channels may also have
/user/or/c/addresses. They still resolve, which is useful: an old/user/name can reveal what a channel was called years ago. - Video ID: the 11-character string after
watch?v=oryoutu.be/. It is permanent for the life of the video.
There is also a neat structural link: every channel's uploads playlist has the same ID as the channel with UC replaced by UU. That playlist lists every public upload in order, which is the cleanest way to review a channel's history.
What Is at Stake: Recycled Footage and Coordinated Channels
YouTube is a major news source in its own right. The Reuters Institute's Digital News Report 2025 found that about 30% of its global sample use YouTube for news each week, second only to Facebook, and highlighted how much news now reaches young audiences through creators rather than publishers. When a false clip spreads there, it reaches people who may never see a correction.
Coordinated campaigns use the platform too. Google's Threat Analysis Group publishes quarterly bulletins of terminated influence operations, and its Q4 2025 bulletin, published in January 2026, lists repeated terminations of YouTube channels linked to Russia, from single-digit clusters sharing content critical of Moldova to one batch of more than a thousand channels. These are networks of channels, not lone uploaders, and the tell-tale patterns (shared upload rhythms, recycled footage, renamed channels) are exactly what the method below brings out. For teams preserving this material as evidence, our Forensic Capture extension records pages with hashes and timestamps.
The Manual Method: IDs, Metadata, Thumbnails and Places
Find the channel ID and record it
If the channel URL already shows /channel/UC..., copy it. If it shows a handle, open the channel's About panel and use "Share channel", then "Copy channel ID", or view the page source and search for channelId. The fastest reliable method is the API, below. Record handle, display name and channel ID together, with the date, every time.
Get exact metadata from the YouTube Data API
The watch page shows rounded dates ("3 days ago") in your local time. The API gives exact ISO 8601 UTC timestamps. Per YouTube's getting-started guide, you need a Google account, a Google Cloud project with the YouTube Data API v3 enabled, and an API key. An API key is enough for public data; OAuth is only needed for private account actions. Restrict the key to the YouTube Data API and store it in an environment variable.
curl -s "https://www.googleapis.com/youtube/v3/channels?part=snippet,contentDetails,statistics&forHandle=@examplechannel&key=$YT_API_KEY"forHandle resolves a handle to the channel resource. snippet returns the title, description, customUrl, publishedAt (the channel creation time) and an optional country the owner chose. contentDetails gives the uploads playlist ID. statistics gives view and video counts. A channel presenting as a decade-old local news service with a publishedAt from last month is your first finding.
curl -s "https://www.googleapis.com/youtube/v3/videos?part=snippet,contentDetails,recordingDetails,status&id=VIDEO_ID&key=$YT_API_KEY"For a video, snippet.publishedAt is the moment it went public. YouTube's video resource documentation is explicit that this "might be different than the time that the video was uploaded": a video uploaded as private and made public later shows the later time. recordingDetails.recordingDate, when present, is set by the uploader and proves nothing on its own. contentDetails.duration helps match re-uploads that were trimmed.
curl -s "https://www.googleapis.com/youtube/v3/playlistItems?part=contentDetails&playlistId=UUxxxxxxxxxxxxxxxxxxxxxx&maxResults=50&key=$YT_API_KEY"Lists the channel's uploads with their publication times, 50 per page. Sudden bursts of uploads, long silences and a switch in language or topic all show up here.
Quota is the main friction. YouTube's quota cost page currently gives projects 10,000 units a day for most endpoints, with channels, videos, playlistItems and commentThreads list calls costing one unit each. Search is handled separately: the page now lists a default allowance of 100 search.list calls per day, and every page of results counts. Older guides describe search as costing 100 units from the shared pool, so check the current page before you plan a big job. Quotas reset at midnight Pacific Time.
Pull thumbnails for reverse image search
Every video has predictable thumbnail URLs, no API needed:
https://i.ytimg.com/vi/VIDEO_ID/maxresdefault.jpg
https://i.ytimg.com/vi/VIDEO_ID/hqdefault.jpg
https://i.ytimg.com/vi/VIDEO_ID/1.jpg
https://i.ytimg.com/vi/VIDEO_ID/2.jpg
https://i.ytimg.com/vi/VIDEO_ID/3.jpgmaxresdefault is the highest-resolution version of the main thumbnail (not every video has one; fall back to hqdefault). The numbered images are small frames YouTube generates from different points in the video. The main thumbnail is often a custom image chosen by the uploader, so the numbered frames are more honest samples of the footage itself. Run them through several reverse image engines: results differ a great deal between them.
Amnesty International's YouTube DataViewer used to do this in one step, extracting exact upload times and thumbnails. When we checked in September 2026 its hostname no longer resolved, and the latest capture we could find is a Wayback Machine snapshot from July 2025. Treat it as retired; the API calls and thumbnail URLs above replace it.
Extract keyframes with InVID-WeVerify or ffmpeg
The InVID-WeVerify verification plugin for Chrome and Firefox remains the standard newsroom tool. Its Analysis tab shows YouTube metadata and interesting comments, the Keyframes tool splits a video into keyframes and sends them to several reverse image engines, and the Thumbnails tool runs the thumbnails through Google, Bing, TinEye or Yandex in one click. Its Magnifier helps read signs and small text in frames.
If you already hold a lawfully obtained copy of the video file, ffmpeg can extract frames at scene changes:
ffmpeg -i clip.mp4 -vf "select='gt(scene,0.4)'" -fps_mode vfr frame_%03d.pngselect='gt(scene,0.4)' keeps frames where the scene-change score exceeds 0.4 (lower it for static footage, raise it for shaky phone video). -fps_mode vfr writes only the selected frames; older ffmpeg builds use -vsync vfr instead.
For metadata, yt-dlp can write a video's metadata and thumbnail without downloading the video. Install with python3 -m pip install -U "yt-dlp[default]"; it needs Python 3.10 or newer, and for YouTube the project now strongly recommends a JavaScript runtime such as Deno alongside it.
yt-dlp --skip-download --write-info-json --write-thumbnail "https://www.youtube.com/watch?v=VIDEO_ID"--skip-download leaves the video alone, --write-info-json saves the metadata YouTube serves to the player, and --write-thumbnail saves the main thumbnail. Read the terms section below before using it at all: YouTube's terms restrict downloading and automated access, and the official API is the right default for anything repeated.
Read the comments for leads
curl -s "https://www.googleapis.com/youtube/v3/commentThreads?part=snippet&videoId=VIDEO_ID&order=time&maxResults=100&key=$YT_API_KEY"order=time returns the newest first; page to the end for the earliest. Early comments are where you find "this is from 2022" corrections, links to the original upload and eyewitnesses saying they filmed something similar. Comments can be disabled, held for review or removed by the channel, so absence is not evidence. If a commenter appears to hold the original footage, contact them openly and ask.
Confirm where footage was filmed from landmarks
Geolocation means matching what is visible in the frame to maps and imagery until only one place fits. Bellingcat's beginner's guide to geolocation is old but the method has not changed: list distinctive features (skyline, towers, bridges, road markings, shop signs, mountain ridges, the shape of a coastline), search candidate areas on satellite and street-level imagery, and confirm with at least two independent matches. Shadows help with time: SunCalc shows the sun's direction for any place and date, so a claimed "8am" clip with short midday shadows is a problem.
Keep geolocation on places and events. The question is where the footage of the fire, flood or protest was recorded, not where any individual in it lives or goes.
Where Does UserSearch Take Over?
The YouTube side of verification is only half the job. The channel links to a website, reuses a handle on other platforms, and its thumbnails and stills need checking against the wider web. Done by hand, that is a spreadsheet of tabs and a folder of screenshots with no timeline.
UserSearch brings those checks together. The Picture Search type runs reverse image search, geolocation and synthetic-image checks on thumbnails and keyframes. Username Intelligence checks a channel's handle across many platforms; our username research guide explains how to read those results. Domain Intelligence covers ownership, history and favicon links for the site in the channel's About panel. OneScan runs one input across the data sources you select and merges results with source attribution, with the Credit cost shown before you run. Bulk search puts up to five inputs through one Module in a batch, which suits a set of related channel handles.
Run the work in a Case with Forensic Mode so the search history and bookmarks are stored, and capture the watch page and channel page with Forensic Capture, which produces SHA-256 fingerprints and two independent timestamps and runs locally in your browser. Everything UserSearch returns is a lead to corroborate; coverage and freshness depend on the third-party source. For the image side, our reverse image knowledge base covers the engines and their quirks.
Verification Patterns That Work on YouTube
Scenario: the "live" port explosion
Context. A fictional regional broadcaster sees a video titled "LIVE: port explosion right now" spreading from a channel called Example City News, handle @examplecitynews.
Actions. The producer resolves the handle through the API: the channel was created 19 days ago and its uploads playlist holds six videos, all dramatic disasters in different countries. The video's publishedAt is today, but the numbered thumbnail frame 2.jpg, run through two reverse image engines, matches a news report of an industrial fire four years earlier. InVID keyframes show a shop sign in a language not spoken in the claimed city. Early comments include two users naming the original event and linking to it.
Outcome. The broadcaster does not air the clip. It publishes a short verification note showing the original report, captures the channel and video pages with hashes, and reports the channel to YouTube as misleading.
Scenario: attributing a network of re-upload channels
Context. A fictional research non-profit, Example Institute, is studying channels that post the same election clips within minutes of each other.
Actions. Researchers list 25 channel IDs and pull each uploads playlist through the API, using well under 1,000 quota units. Twenty channels were created in the same fortnight, 14 have legacy /c/ URLs from a previous life as gaming channels, and upload times cluster within a three-minute window after each original. Several channels link to the same site at example.org, and domain infrastructure research shows it shares hosting with two others.
Outcome. The report describes the network by channel IDs, timing and shared infrastructure, publishes the method, and shares the list with YouTube's trust and safety contacts. It makes no claim about who operates the network beyond what the evidence supports.
Checking a company's official channel
For due diligence and brand work, confirm that a company's channel is linked from its official website, that the channel ID in the site's link matches the one you are looking at, and that the channel's creation date fits the company's history. Lookalike channels usually fail at least one of those checks.
Establishing the earliest copy of a clip
When a clip exists on several channels, the earliest publishedAt is a starting point, not an answer: a channel may have uploaded privately earlier and published later, or a copy may predate YouTube on another platform. Record every copy with its channel ID and UTC time, then look outside YouTube.
Terms, Quotas and Proportionate Research
YouTube's Terms of Service prohibit accessing the service by automated means except for public search engines or with YouTube's prior written permission, restrict downloading content without permission, and prohibit collecting information that might identify a person without their permission. The official API is the sanctioned route for repeated or bulk access, and the YouTube API Services developer policies require you to delete or refresh stored API data within 30 calendar days. Build your retention around that. If you need to keep a video as evidence, capture the page, record the IDs and times, and take legal advice on downloading the file.
Data protection law applies to what you collect. Under the UK GDPR and EU GDPR, record a lawful basis (journalism or legitimate interests are the usual ones), collect what answers the question, and keep people out of the analysis unless they are the public actors your story is about. In practice:
- Focus on channels, videos, organisations and events, not on individuals' private lives.
- Use geolocation to establish where footage was filmed, and stop there.
- Blur or omit bystanders' faces and private individuals' names in anything you publish.
- Contact uploaders and commenters openly, as yourself, and ask permission before using their footage.
Frequently Asked Questions About YouTube OSINT
What is YouTube OSINT?
YouTube OSINT is the use of public YouTube material, including channels, videos, metadata and comments, to answer a verification or attribution question. YouTube OSINT relies on the difference between a channel's changeable labels, such as its handle and display name, and its permanent identifiers: the channel ID beginning UC and the 11-character video ID.
How do you find a YouTube channel ID?
A YouTube channel ID is a 24-character string beginning UC. If the channel URL shows /channel/UC..., copy it. Otherwise use Share channel, then Copy channel ID, in the About panel, search the page source for channelId, or call the YouTube Data API channels endpoint with forHandle, which needs a free API key.
Does the YouTube published date show when a video was filmed?
No. A YouTube video's publishedAt time is the moment it went public, which may differ from when it was uploaded: a video uploaded as private and made public later shows the later time. The optional recordingDate is set by the uploader and proves nothing on its own. The YouTube Data API returns exact UTC timestamps.
How do you reverse image search a YouTube video?
Pull the thumbnails from predictable URLs on i.ytimg.com, including maxresdefault, hqdefault and the numbered frames 1.jpg to 3.jpg, which sample the footage itself rather than a custom image. Run them through several reverse image engines. The InVID-WeVerify plugin can also split a YouTube video into keyframes and send them to several engines at once.
Is Amnesty's YouTube DataViewer still available for YouTube OSINT?
Amnesty International's YouTube DataViewer, which extracted exact upload times and thumbnails, appears to be retired. When we checked in September 2026 its hostname no longer resolved, and the latest capture we found was a Wayback Machine snapshot from July 2025. YouTube Data API calls and direct thumbnail URLs now replace it.
How much YouTube Data API quota do you get?
YouTube's quota page currently gives projects 10,000 units a day for most endpoints, with channels, videos, playlistItems and commentThreads list calls costing one unit each. Search is handled separately, with a listed default of 100 search.list calls per day, and every page of results counts. Older guides describe search differently, so check the current page.
From Viral Clip to Verified Footage with UserSearch
YouTube verification comes down to a few habits: anchor every channel to its UC ID, trust UTC times from the API over rounded dates on the page, reverse search the numbered thumbnail frames and keyframes, read the earliest comments, and confirm where footage was filmed from fixed landmarks. With those done, a viral clip becomes a set of checkable facts.
Stop guessing. Start researching with UserSearch. One UserSearch account gives your team 18 Search types and access to 100+ third-party data sources, so the handle, website and images behind a YouTube channel can be checked in one place. OneScan merges results with source attribution, Cases in Forensic Mode keep the audit trail, and SargeBot can help you build entity searches and draft a PDF report that you verify before it is used. Start your next video verification with UserSearch.