Installing more OSINT tools rarely fixes an investigation. Opening the right tool at the wrong stage can still waste an afternoon.
The mistake I see most often is starting with the largest possible sweep. Someone has a username, so they run three username enumerators. Someone has a domain, so they open Shodan before checking the site itself. Someone has a photo, so they upload it to every reverse-image engine and treat zero results as a dead end.
The useful unit is not a list of tools. It is an order of operations. Each stage should either answer the question cheaply or produce a better input for the next stage.
The order matters more than the list
My default workflow has six stages:
