Missing Person (TryHackMe)
Introduction
OSINT (Open Source Intelligence) challenges simulate real-world investigations using only publicly available information. This room on TryHackMe presents a missing person scenario tied to the 2025 MotoGP event in Indonesia, where we're tasked with helping piece together the movements of a traveller based on photos and social media breadcrumbs they left behind.
The investigation covers image metadata analysis, reverse image search, geolocation, social media profiling, and business record lookup — core skills in any OSINT workflow.
Tools used:
exiftool— for extracting image metadataGoogle Reverse Image Search — for identifying locations from photos
Google Maps — for address verification
Facebook / Instagram — for social media enumeration
Google Search — for business and phone number lookup
OSINT
"My friend went on holiday in 2025 and shared some photos, but I haven’t heard from him since. Can you help me track him down for the police report?"
Download the zip file attached to this task and start your investigation!
Answer the questions below
What is the commercial name of this circuit?
Format: English, full commercial name.
Download the zip file, then unzip: there are two images, and one of them is for the circuit
Use Google Image Search to search for the MotoGP image to identify the circuit where the event was held
When did the event take place?
Format: DD-DD/MM/YYYY.
exiftool MotoGP.jpg
Using the circuit name we identified above, we can search when the MotoGP happened in this specific circuit
He told me he ate delicious Mexican food. What is the name of the restaurant?
The other image from the zip file was the food image. We can use Google Image Search to identify the restaurant where this missing person visited
At what time was this photo taken?
Format: HH:MM:SS.
exiftool food.jpg
He sent me a message, this is the last I heard from him: ”Went to this cool MotoGP after party, and became friends with one of the local DJs who played that night. We’re going to visit a cave tomorrow.”
What is the full address of the bar’s location?
At first, I came across that there was an After Race Party that was held at Mandalika Beach Club, it has a DJ lineup, but none fit what we're looking for
On reading the message once again, the missing person specified that they went to a bar for the after-party. After searching again, I found Surfers Bar, which was advertised on Facebook and Instagram
Went ahead to search for Surfers' bar using Google Maps inorder to find the exact location.
What is the DJ's stage name?
This was a bit of a tricky question, I looked around for the DJ alot. At first, I thought it would be the naked_feelthevibe who had commented on the event post, but it seems he's not a local DJ. I had not paid attention to the fact that the event poster had a list of djs but eventually went back to the announcement and found it.
Here's the DJ set:
What is the name of the cave?
to find this had to search for a cave near Surfersbar lombok
What is the phone number linked to his old business?
Format: Full number, no country code.
Thing to keep in mind, they're interested in the phone number linked to his old business so the first doesn't pass
Scrolling through the second search results, we find a phone number linked to bongleleh and the cave.
Conclusion
This room was a solid end-to-end OSINT exercise. Starting from just two images and a short message, we were able to reconstruct an entire timeline — the event, the restaurant, the after-party bar, the DJ, a cave visit, and even an old business phone number.
Key Takeaways:
exiftoolis your first stop on any image — timestamps and GPS data are often embedded and overlookedReverse image search is surprisingly powerful for geolocating food, venues, and landmarks
When a lead goes cold, re-read the original message carefully — the distinction between a "bar" and a "beach club" was the pivot point for finding the after-party location
Event posters and social media announcements often contain the most direct answers; don't overlook them while chasing indirect clues
Old business listings and cached pages can surface phone numbers long after the business has changed
OSINT is a reminder that the digital footprint we leave — through photo metadata, social media comments, tagged locations, and business registrations — can be traced by anyone with the right methodology. From a privacy standpoint, stripping metadata before sharing photos and auditing your public social presence are practical first steps.
