Google Operators Every Investigator Should Know

Find email addresses at a company

site:acme.com "@acme.com"

Then widen it — documents leak addresses even when the website doesn’t:

"@acme.com" filetype:pdf
"@acme.com" filetype:xlsx OR filetype:docx

One confirmed address gives you the pattern, and the pattern gives you everybody. Feed it into the email permutation generator.

Find documents a site didn’t mean to publish

site:townname.gov filetype:xls OR filetype:xlsx

Municipal sites publish spreadsheets constantly — salary schedules, permit lists, vendor payments, voter lists, tax delinquency rolls. They’re indexed and almost never linked from anywhere a person would browse.

Swap in filetype:pdf for minutes, agendas and hearing transcripts.

Find a person on a site that has no search

site:reddit.com "u/username"
site:x.com OR site:twitter.com "@handle"

Platform search is weak on old content. Google indexed it while it was public and often still holds it. This is the single most useful trick for social work.

The Reddit and X builders do both versions for you.

Find the person behind a business

"acme construction" ("owner" OR "president" OR "principal")

Then check the license and permit trail:

"acme construction" site:*.gov

Licensing boards, permit portals and procurement records all sit on .gov and all name responsible individuals.

Find an address history

"james harris" "14 mill road" to confirm a pairing.

"james harris" ("moved" OR "formerly of" OR "previously of") for the transitions.

Obituaries are the richest source of family and place, which is why the exclusion -obituary is sometimes wrong — try it both ways.

Narrow by time

Run the search, then use Tools → Any time to bound it to a year or a custom range.

This is the most under-used control on the page. If you know roughly when something happened, bounding the date turns an unusable result set into a readable one.