How does Ghost Finder recover deleted social media profiles?
In a full scan, Ghost Finder uses the Wayback Machine CDX Server API to discover archived snapshots of social media profile URLs across 90 platforms, including 21 defunct networks. When a user deletes their account or gets suspended, the Wayback Machine may have captured the page while it was still publicly accessible. With nothing installed, Ghost Finder runs a quick check through the Wayback Machine availability API and links the most recent capture of each profile it finds. With the free Max Intel Archive Helper userscript, it runs a full scan: it fetches the archived snapshots from your own browser and applies platform-specific extraction patterns to recover bios, display names, emails, locations, websites, and linked accounts.
Which defunct networks can it search?
Twenty-one of the 90 platforms are closed or have purged their old accounts, so an archived capture is often the only copy left: Vine, Google+, Friendster, Bebo, hi5, the original Parler (2018–2023), Periscope, Ello, Formspring, Posterous, Xanga, FriendFeed, Identi.ca, Delicious, Klout, Storify, Mixer, Picasa Web Albums, Windows Live Spaces, GeoCities and AOL Hometown/Members pages. Each platform is queried under every profile address the archive is likely to have captured — for example twitter.com and x.com, threads.net and threads.com, periscope.tv and pscp.tv — and the search stops at the first address that has captures. Use the Defunct only preset to hunt only these, or Major only for a quick pass over the 14 biggest networks.
What makes archived social profiles valuable for OSINT investigations?
Deleted profiles often contain information the subject believed was permanently erased. According to the OWASP Web Security Testing Guide v4.2, search engine and archive reconnaissance is a foundational information-gathering technique. The Wayback Machine archives over 1 trillion web pages (a milestone reached in October 2025) per the Internet Archive, making it the largest source of historical web data for passive reconnaissance.
How does cross-platform identity correlation work?
The cross-reference engine collects every extracted data point across all scanned profiles and identifies shared identifiers that connect accounts. This technique, described in the SANS Institute OSINT collection guidelines, builds an identity graph that reveals connections even when individual profiles have been removed. The CDX API returns timestamped snapshots enabling temporal analysis of profile changes. All processing runs client-side in the browser as recommended by the OWASP testing methodology for passive reconnaissance workflows.
- Ghost Profile
- A social media account deleted, suspended, or privatized but previously captured by the Wayback Machine.
- CDX API
- The Wayback Machine's search interface for discovering archived URLs with timestamps and HTTP status codes.
- Cross-Platform Correlation
- Identifying shared identifiers across social media platforms to link accounts belonging to the same individual.
- Passive Reconnaissance
- Information gathering that does not directly interact with the target's infrastructure.
👻 Social Media Ghost Finder — Frequently Asked Questions
How does Ghost Finder recover deleted social media profiles?
Ghost Finder looks up social media profile URLs in the Wayback Machine. By default it runs a quick check: one availability lookup per profile, straight from your browser, which reports whether a profile was archived and links its most recent capture. With the free Max Intel Archive Helper userscript installed, it runs a full scan instead: it lists the profile's snapshots in the Wayback Machine CDX index, fetches the archived pages from your own browser, and applies platform-specific extractors to recover bios, emails, names and linked accounts.
What platforms does Ghost Finder support?
Ghost Finder checks 90 platforms, grouped in the platform picker. Major (14): Twitter/X, Facebook, Instagram, LinkedIn, GitHub, YouTube, TikTok, Reddit, Threads, Bluesky, Telegram, Snapchat, Pinterest and Tumblr. More live services (55): Medium, Mastodon, MySpace, Flickr, DeviantArt, SoundCloud, LiveJournal, Vimeo, Twitch, Steam, Last.fm, Quora, Keybase, Foursquare, About.me, Dribbble, Behance, Truth Social, Gab, Minds, Rumble, BitChute, Kick, Patreon, Substack, Blogger, WordPress.com, Linktree, Gravatar, Imgur, Pastebin, Letterboxd, Chess.com, Lichess, Hacker News, Product Hunt, Disqus, Etsy, eBay, Wattpad, Archive of Our Own, Dailymotion, Mixcloud, Bandcamp, Ko-fi, Fiverr, GitLab, VK, OK.ru, MyAnimeList, Duolingo, Spotify user profiles, Plurk, Ask.fm and GETTR. Defunct or archive-only services (21), where the Wayback Machine is often the only copy left: Vine, Google+, Friendster, Bebo, hi5, Parler (2018–2023 accounts), Periscope, Ello, Formspring, Posterous, Xanga, FriendFeed, Identi.ca, Delicious, Klout, Storify, Mixer, Picasa Web Albums, Windows Live Spaces, GeoCities and AOL Hometown/Members pages.
How long does a scan take?
A quick check, the default, makes one to four Wayback Machine availability lookups per profile, one every 5 seconds, because the archive blocks browsers that look up much faster. One username across the 14 major platforms takes about 2 to 4 minutes, and across all 90 platforms about 10 to 25 minutes. If the archive still asks for a slower pace, the scan pauses for a minute or more and then carries on by itself. A full scan, which needs the Archive Helper, checks one profile at a time: it looks the profile up in the Wayback Machine CDX index, then fetches up to the chosen number of snapshots one after another, waiting the selected delay (1500, 2500 or 4000 ms; 2500 ms by default) between snapshots and half a second between platforms. Its estimate is profiles × snapshots × delay, so one username across the 14 major platforms with 5 snapshots at 2500 ms is estimated at about 3 minutes, and across all 90 platforms at about 19 minutes; profiles with no archived captures are skipped after the lookup, so real scans usually finish sooner. In both modes Stop ends the scan after the request in progress and shows what was found so far. If 3 archive lookups in a row fail, Ghost Finder stops and says the Wayback Machine could not be reached, listing the remaining profiles as not checked instead of reporting no snapshots. If the Wayback Machine starts rate-limiting your IP, the scan pauses or slows down and carries on; anything it still could not check is listed, with a Retry not-checked button that keeps the results already found.
What is the difference between a quick check and a full scan?
A quick check needs nothing installed. For each profile URL your browser asks the Wayback Machine availability API whether a capture exists and gets back the most recent one, which Ghost Finder links. It cannot read archived pages, so it recovers no bios, emails or linked accounts, cannot tell ghost or private profiles apart, and its no-capture answers are not conclusive, because that API sometimes misses URLs that are archived. A full scan needs the free Max Intel Archive Helper, a small Tampermonkey or Violentmonkey userscript that only talks to archive.org and only on maxintel.org. It lets Ghost Finder search the full snapshot index, read archived profiles, extract bios, emails, names and linked accounts, and cross-reference them. In both modes requests go from your own browser and IP to archive.org; nothing passes through a Max Intel server.
How does cross-referencing work?
The cross-reference engine identifies shared emails, names, and websites across profiles on different platforms to link accounts belonging to the same person.