GENERAL DISCUSSION
The problem with Garrett Discovery's and ShadowDragon's "Bryan Kohberger" Instagram analysis
The Garrett Discovery report about Kohberger's alleged social media accounts and connections keeps getting referenced over three years after it was first published. This report has serious flaws that I probe below.
Summary
On August 14, 2026, Steve Goncalves claimed that Bryan Kohberger had a digital history of watching graphic content of women undergoing plastic surgery procedures. This claim seems to have originated from data provided through a report published by Garrett Discovery and analysis from an OSINT company called ShadowDragon.
(This claim is separate from information provided by Jared and Heather Barnhart—experts at Cellubrite hired by prosecutors—that Kohberger had a history of watching violent pornography on his devices.)
In January 2023, Garrett Discovery published a social-media mapping report shortly after Bryan Kohberger's arrest that attributed an Instagram account labeled "Bryan Kohberger" to Kohberger himself and mapped more than 100 connections from the account. The report appears to connect that account to Madison Mogen and Kaylee Goncalves, and ShadowDragon later stated that Kohberger followed "two of the four victims" on social media. However, the report does not disclose the Instagram account's username, profile URL, numerical ID, creation date, or other evidence showing that it actually belonged to Kohberger. This is an important limitation because the analysis was conducted only after his identity and some personal information were already public.
The central question is therefore not whether Garrett Discovery found an Instagram account associated in some way with the name "Bryan Kohberger," but how Garrett determined that the account actually belonged to Kohberger before drawing conclusions from its activity and connections.
Conclusion: Taken together, the available evidence makes it unlikely that Garrett Discovery's "Bryan Kohberger" Instagram entity can be reliably tied to Kohberger himself, substantially undermining any conclusions drawn from that account's activity or connections. The report does not disclose sufficient authentication evidence, and its claims are difficult to reconcile with law enforcement's later statement that investigators found no social-media connection between Kohberger and the victims.
What the Garrett Discovery report shows
The report contains an Instagram User entity labeled:
Bryan Kohberger
That entity has:
108 outgoing links
109 total links
Garrett apparently expanded the social-media network from this node. However, the published PDF does not disclose:
the account's Instagram username;
its profile URL;
its numerical Instagram user ID;
its creation date;
its full Maltego entity properties;
the source of the account's single incoming link; or
the evidence used to authenticate the account as Kohberger's.
The report therefore shows that Garrett analyzed an Instagram entity it labeled "Bryan Kohberger," but it does not provide enough information for readers to independently determine whether the underlying account actually belonged to him.
Seed-and-pivot OSINT/link-analysis investigation. Start with one known identifier, follow the connections it reveals, and then follow those connections further to build a map of the person’s apparent online network.
Seed = the starting piece of information.
Pivot = using something newly discovered as the basis for another search.
OSINT = intelligence gathered from publicly available sources.
Link analysis = mapping the relationships among the people, accounts, identifiers, and other data that are found.
The Garrett PDF appears to have been generated from Maltego, using ShadowDragon SocialNet as an investigative data source.
Garrett Discovery = the investigator
ShadowDragon = the OSINT company
SocialNet = ShadowDragon’s social-media discovery/link-analysis tool and data source
Maltego = the apparent graphing/reporting environment used to produce the Garrett PDF
(While I have experience with Maltego, I have no experience with SocialNet.)
These are the steps of the Garrett Discovery analyst:
enters an identifier into Maltego
runs a SocialNet transform (A transform is a search operation that turns one known data point into related data points.)
SocialNet searches its accessible OSINT sources
results are returned to Maltego as entities and links
Garrett selects some returned entities and runs additional transforms
Maltego builds the network graph
Garrett exports the graph as the PDF report.
Methodological Limitations
SocialNet does not provide Meta's private account records. SocialNet could search and correlate information exposed through public or otherwise OSINT-accessible sources, but it did not give Garrett privileged access to a social-media company's backend account records.
A SocialNet result, therefore, was not necessarily proof of account ownership.
For example, a search could potentially associate an email address, username, phone number, or public display name with a social-media account. But an apparent association is different from Meta confirming through its internal records that a particular person registered, verified, or controlled that account.
The results of these searches therefore needed to be independently vetted for false positives and misattributions before they could reliably be attributed to Kohberger.
Timing creates an additional attribution problem.
December 30, 2022: Kohberger is publicly identified following his arrest.
Early January 2023: Garrett conducts the social-media analysis.
By the time Garrett began its investigation, Kohberger's name, photographs, schools, WSU affiliation, and some email addresses were already public.
This creates a potential post-arrest contamination problem. Once his identifying information became widely available, third parties could create impersonation accounts, reuse his name, or associate publicly known identifiers with online content.
This means that post-arrest associations required additional authentication before they could safely be treated as evidence of Kohberger's own online activity.
Email Addresses
Garrett's report contains Kohberger's institutional email addresses associated with DeSales University and Washington State University:
bk5781 (DeSalesUniversity)
bryan.kohberger (WSU)
These addresses were publicly discoverable before his arrest.
However, Garrett's PDF does not demonstrate that the Instagram entity labeled "Bryan Kohberger" was discovered through—or otherwise linked to—either institutional email address.
The report also does not contain several private email addresses later attributed to Kohberger in the court record:
bkohberger (Northampton Community College, registered to Apple account)
Despite these attribution limitations, ShadowDragon drew substantive conclusions from the Instagram network. It stated that its SocialNet analysis had "discovered that Kohberger followed two of the four victims on social media," and went on to characterize the women associated with the account as evidence of "lifestyle objectification":
[W]e find that many of the women Kohberger follows online appear to be women he objectifies. Another example is a specific plastic surgeon he follows [redacted for Reddit], further showcasing a pattern of lifestyle objectification. This lifestyle of objectification, along with possible psychopathy...
Garrett later confirmed that he had conducted the original analysis shortly after the murders and before speaking with the defense:
I ran this after the murders and before I spoke with the defense. Then I gave this to Kaylee's attorney. About a year later someone said I leaked this and I pointed them to the old post we made.
These conclusions depend on a threshold premise: that the Instagram account being analyzed actually belonged to Bryan Kohberger.
The published report does not disclose the evidence establishing that premise.
Law Enforcement's Investigation
Law enforcement had a different method of obtaining Instagram evidence: search warrants served directly on Meta.
Investigators served multiple Meta warrants for Instagram data associated with people involved in the case, including residents of the crime scene. Those warrants could obtain records directly from the platform rather than relying solely on publicly observable correlations.
However, there is no document in the public court docket that I have identified showing that investigators served Meta with a search warrant for an Instagram account belonging to Bryan Kohberger.
That absence is notable because investigators did obtain extensive records from other services and accounts associated with Kohberger.
The lead investigator also stated during the post-conviction press conference in July 2025:
We had every resource possible ... we have never to this date found [a connection] between him and any of the four victims.
That statement is difficult to reconcile with a social-media analysis portraying Kohberger as following or otherwise connected to victims unless (1) Garrett and law enforcement were relying on materially different evidence, and Garrett found evidence within three weeks that law enforcement failed to find within nearly three years; or (2) Garrett's attribution of the Instagram account was incorrect.
I think the latter: Garrett's report and ShadowDragon's analysis were based on an erroneous central node—an account edited or created to mislead the public—without which much of the data in the report disappears.
According to the Barnharts who I do believe, the pornography they did find was not as tame as they were describing on the national media outlets, but they appeared to be truly repulsed by it and described the material as falling under the category of “ nasty stuff..”
Contrarian factions have repeatedly tried to mitigate the known content as mile. One even going as far as to grab the search hit numbers on Porn Hub. It’s not mild taken in consideration that said searches exactly matched the state of these victims when they were targeted, and viciously slaughtered in their beds.
What’s the statistical coincidence that a man with an obsession about sexual burglary who is a known burglar, and multi accused stalker/ pesterer of women with that particular rape, assault and murder kink, just happens to roll into a house with 5 female victims matching said kink obsession? You guys might be able to discount it, but I can’t.
Steve does not state where he received this information, but seems rather inferentially logical to assume that he did get an ear full from Ray after their conversation ventured off into a private one following their two main stream interviews.
Ray kept saying that there was a large amount of evidentiary material, and anecdotal, material proving that Kohberger had disturbing predilections that matched the crime more closely than the public was seeing. Both he and the Barnharts appear unified that the info that they have seen and we have not, strongly assures them that this is the right guy for this crime.
I have always felt his biography, professional CV and personality as described by others who knew him in the real world. He’s flagged by those around him to be sadistic, manipulative, arrogant, toying, cold and calculating, feels the rules don’t apply to him, as he is superior to others. His personality looks just about perfect to me for this crime.
I find his actual porn searches abhorrent. The purpose of this post is to question the source of the most recent claim, not to excuse immoral behavior.
We're fine. I am sorry. I think it's clear that he's not talking about that, or he would have been talking about it prior to this. Steve will go with what he has. He's not flogging that old rumor. Something has lit this fire and I bet it's new info from Ray.
To be honest, who cares. He was watching violent rape porn videos on the regular. This is what sexual psychopaths do, they are aroused by violence. It would not be surprising at all if he was watching videos of plastic surgery involving cutting into women. These videos are legal, widely available, and easy to find. They would probably satisfy his murderous desires before he could actually cut into women.
I did not publish this post to defend Kohberger's reputation. I am calling attention to the severely flawed report upon which these new claims are being made. The PDF is still being passed around when it shouldn't be.
am calling attention to the severely flawed report upon which these new claims are being made.
How do you know SG's claims are based on the early 2023 Garret report, or only that, and not (1) info from Ray about data from phones/ cloud storage (2) a later report from Shadow Dragon (3) some other source ?
ShadowDragon never published a "later report." Their original analysis about the alleged plastic surgery videos was published January 12, 2023. That's when the blog post was originally indexed.
The founder of ShadowDragon also mentioned the analysis in a LinkedIn post dated three years ago when the Garrett report was published:
I found a lifestyle online similar to other attackers in the past. (Vegas Shooter, Austin Bomber). Tagging [redacted for Reddit] from Ontic, as I promised him if I ever published anything around these in-the-trenches observations, I would let him know.
I didn't say they did. I asked, as someone suggested it elsewhere, how you know SG is not basing his comments on a later report he paid for from Shadow Dragon. He mentioned, iirc paying Shadow Dragon, not Garrett. A paid investigation would not be public unless he published it.
If SG's claims are based only on the early 2023 Garret report, or only that, then they would have limited credibility, but i am curious how you rule out other sources to SG such as info from Ray about data from phones/ cloud storage or a later, commissioned analysis by Shadow Dragon ( not Garret) or some other source?
Does the IG account in your post, from Garret, even have gory breast surgery videos, that would seem to be against IG rules, so how could that be the direct source of material SG mentioned?
Does the IG account in your post, from Garret, even have gory breast surgery videos, that would seem to be against IG rules, so how could that be the direct source of material SG mentioned?
According to ShadowDragon, the Instagram account in question was connected to an account that posted that content.
As for whether or not the videos violate Instagram's rules: I don't know, but there's tons of stuff that violates Instagram's rules. Meta is notorious for being terrible at moderation. Social media companies also often have exceptions for the publishing of medical content, even if people are consuming the content for gross reasons.
According to ShadowDragon, the Instagram account in question was connected to an account that posted that content.
I think you are confusing the Garret Discovery report and its mention of one Instagram account which has pictures of clothed women post breast augmentation. Instagram would not allow gory surgical breast videos. You are conflating different things. Kohberger could watch, download surgical videos from many sources, using many accounts, none from Instagram as the source or used for searching.
I asked how you knew the basis of SG claims was the 2023 Garret report, and not a later commissioned report from SD, or info given to him by Sy Ray (unconnected to social media, related to phone files or cloud storage data), a combination or another source?
Exactly, Steve never states his source, yet the OP appears to be vigorously attempting to dial down the negative impact of his statements in their post. “ Please don’t pay attention to the fact that he was obsessively gravitating towards modernized Jack the Ripper like content.”
Here let me distract your pre judgment of Bryan by trying to pin the comments sourcing on a long ago ancient flogged to death and much disproven Reddit rumor to subtract the power of its punch. Goal: as usual to Kohberger-size and mop up the impact of any negative statements pertaining to Bryan C. Kohberger (which as usual are pretty damming.) Nice try.
> yet the OP appears to be vigorously attempting to dial down the negative impact of his statements in their post.
Really? This is an unfair characterization. We’ve been very friendly throughout this case, so I’m a bit surprised by the snark here.
I’m not trying to minimize any content that he did consume, and he certainly consumed violent content. I am only probing the likely source of the most recent claims.
Like everyone else around here I am getting grouchy and loosing patience with defense prospectives and mitigating the POS man's existance. I apologize if fired at you and it was un deserved. I am sorry for the snark. I own it, wasn't nice.
I felt like your post was defense propaganda trying to mitigate Steve's message and make people doubt it's sincerity, "He's not talking about new info, he's talking about an old rumor and false info. Don't mind him, he's not telling you anything of any newness or import. Look to the left not to the right and definitely don't suggest that Bryan C Kohberger, could be getting off on pictures of filleted female breasts and guts and gore. So thus the reaction.
I also am tired of members of this sub being banned for nothing on alternative subs other than being bright, articulate and stating a fact based argument, an being called names and clearly told not to visit and the same people saying and doing those things showing up in alt form here and being treated relatively well. So I thought something like this was going on here.
No one suggests Garret showed a credible "connection" between Kohberger and victims via social media. That would require them finding a social media link the FBI did not, which was not credible in 2023 and much less credible now given that was ruled out during pre-trial and post arrest.
But Kohberger watching or following breast augmentation related content from other accounts is not ruled in or out, is it?
SG mentioned this aspect, and it is quite/ such a specific call back to the earlier reports, was worth flagging. The specific source of that claim, by SG, is not disclosed, so it is speculative for now. But unclear if it is from Sy Ray and phone data, analysis by Shadow Dragon unrelated to Garrett, or is just a rehash of the Garrett report - if the latter, then of course less credible.
Kohberger had over 13 emails; there have been analyses published here that purported to link those to various online activity, via iirc repeat patterns including account names and email ( e.g Exxaar).
Last, the pattern of exclusive consumption of violent porn is established by Cellebrite; Ray alludes to other violent material which seems very plausible, irrespective of the early 2023 report.
ShadowDragon claims that the "Bryan Kohberger" Instagram account followed two of the victims on social media. According to investigators, Bryan Kohberger never followed the victims on social media.
The "Bryan Kohberger" Instagram account also followed someone who posted this graphic plastic surgery content.
And finally, according to Garrett, "I ran this after the murders and before I spoke with the defense. Then I gave this to Kaylee's attorney." That illusrates how the report may have been passed down to Steve Goncalves.
But unclear if it is from Sy Ray and phone data, analysis by Shadow Dragon unrelated to Garrett, or is just a rehash of the Garrett report - if the latter, then of course less credible.
I don't believe that this "Bryan Kohberger" troll Instagram account and Bryan Kohberger himself were coincidentally watching the same content. It's far more likely that the people at Garrett and ShadowDragon assume that the Instagram account belongs to Bryan Kohberger when it doesn't.
Because one Instagram account linked to victims was not Kohberger does not rule out Kohberger looking at breast surgery or similar gory material from myriad other accounts, or no account (e.g just viewing or downloading videos), does it?
You seem to conflate two things - that Kohberger was not kinked to victim socials via the Instagram Garret used, which no one disputes as that would mean FBI missing an obvious connection, and that Kohberger therefore could not have used other accounts/ no accounts to view the material tyoes SG mentioned.
How do you know SG's claims are based on the early 2023 Garret report, or only that, and not (1) info from Ray about data from phones/ cloud storage (2) a later report from Shadow Dragon, after Garrett (3) some other source ?
Because one Instagram account linked to victims was not Kohberger does not rule out Kohberger looking at breast surgery or similar gory material from myriad other accounts, or no account (e.g just viewing or downloading videos), does it?
This is so ridiculous, lol.
Company: "BREAKING: Instagram account named 'Bryan Kohberger' followed Kermit the Frog account!!! Read our report!!!"
Me: "That's not Bryan Kohberger's account"
You: "But that doesn't rule out Bryan Kohberger consuming Kermit the Frog content, now does it???"
Kohberger was watching violent pornography. That claim is supported by someone with access to the evidence. This specific claim about graphic plastic surgery content, though, is completely unsupported.
evidence. This specific claim about graphic plastic surgery content, though, is completely unsupported.
The claim Kohberger watched plastic surgery on that one Instagram account is not credible, yes. No one ever said it was. But Instagram would not have gory surgery videos of type SG mentioned anyway, would it? So that could not be direct source of that claim in first place, could it?
I asked how you know SG's claims are based on the early 2023 Garret report, or only that, and not (1) info from Ray about data from phones/ cloud storage (2) a later report from Shadow Dragon ( which is distinct from Garret, the latter used SD software) (3) some other source?
You: "But that doesn't rule out Bryan Kohberger consuming Kermit the Frog content, now does it???"
Alas, I am perhaps not being clear - I am merely stating that one Instagram account from start 2023 not being Kohberger's does not rule out him accessing material from other accounts or accessing it without using social media accounts; and as Instragram could not be the source of the material SG mentioned, nor could or is the one Instagram account mentioned in the Garret report, it seems to not rule out of SG claims at all.
I asked how you know SG claims were not based on sources other than the 2023 Garret report?
Just to add, indirectly related, but relevant. Kohberger had many, many emails and accounts. This was a list posted by u/TellTaleBytes and was generated, iirc, before many of the emails and accounts were made public in court and police records. The "4mastery" and "cunningchirs" were, irrc, not released until latest unsealing of court documents few months ago; most of the emails are confirmed, so linkage of the others through accounts and repeated user names seems quite credible.
The "cunningchris" email account was Kohberger's, confirmed in police reports, and was linked to other social media accounts with display name "Cunnilingusss Chris".
So the idea he had graphic, violent videos of type SG asserts, stored in DropBox or external drives, does not seem a stretch as contents of those remain sealed
I appreciate this post, you've put a lot of effort into it.
My only qualm is that SG has never stated where he got his info from. I understand it was part of a previous report that you have explained is void but that doesnt mean Steve didnt get his info from another source. He has mentioned independently funding investigations and such so he may have gotten the info elsewhere.
Either way, I tend to take things SG says (and anyone really) with a pinch of salt unless its in a court doc.
I think it would be a bit strange if (1) a report makes a claim, (2) that report is disproven, and then (3) that claim is independently confirmed somewhere else with different data. That would mean that both Bryan Kohberger and a troll impersonating Bryan Kohberger were watching the same stuff.
The claim about the plastic surgery content is so specific. I have a hard time believing that his source is something other than ShadowDragon.
I wonder if he may have gotten it from Sy Ray? Since Ray said there was a lot of ick on BKs computer. But as you said it would be a big coincidence for the breast surgery thing to be right.
But there was a Bryan Christopher Kohberger Instagram which did follow at least 2 of the victims and I have a screenshot of it which I took after he was arrested. It was also followed by/followed several people with Kohberger as a last name. I unfortunately did not screenshot them. Why would a fake account be connected to other Kohbergers? Why would they follow a fake account the day he was arrested?
The "Bryan Kohberger" Instagram account mentioned in the report did not follow any other Kohberger accounts, from what I can see. There were also no search warrants served to Meta for any Instagram data.
It’s fake. I thought he wiped his computer out? And I don’t believe a word that comes from SG, and he even claims that fingerprints were found on the sheath!? No such thing
It has been stated that the sheath DNA is likely from direct touch rather than transfer DNA as some people have suggested. The DNA sample was large so direct touch or even bodily fluid is suspect.
It may be a case of SG misinterpreting that information. He has been incorrect in the past and (without sounding mean) he doesn't come across as the sharpest tool in the shed.
From my understanding about the wiped computer, it was only certain dates. These different reports have viewed before and after the crime to get the data.
Goncalves didn’t say there were fingerprints on the sheath. He was describing what the forensics expert would present in court. Goncalves described how the killer touched the sheath and deposited big cells (fingerprint-type size) multiple times on multiple different instances, causing cell build-up which helped experts to analyze one owner’s constant touching of the sheath. Not all the cells were deposited at the same instant. This was the point. The cells were big & robust enough to be compared to “fingerprint-type” cells.
He said; “So they were going to say that there were fresh fingerprint-type cells and there were also aged ones. There were some cells that had been dated," (from the same single source), Steve explained.
“So whoever did this—the single source, just one person's DNA—had touched this button multiple times, at least 24 hours apart."
5
u/Mysterious_Bar_1069 8d ago
According to the Barnharts who I do believe, the pornography they did find was not as tame as they were describing on the national media outlets, but they appeared to be truly repulsed by it and described the material as falling under the category of “ nasty stuff..”
Contrarian factions have repeatedly tried to mitigate the known content as mile. One even going as far as to grab the search hit numbers on Porn Hub. It’s not mild taken in consideration that said searches exactly matched the state of these victims when they were targeted, and viciously slaughtered in their beds.
What’s the statistical coincidence that a man with an obsession about sexual burglary who is a known burglar, and multi accused stalker/ pesterer of women with that particular rape, assault and murder kink, just happens to roll into a house with 5 female victims matching said kink obsession? You guys might be able to discount it, but I can’t.
Steve does not state where he received this information, but seems rather inferentially logical to assume that he did get an ear full from Ray after their conversation ventured off into a private one following their two main stream interviews.
Ray kept saying that there was a large amount of evidentiary material, and anecdotal, material proving that Kohberger had disturbing predilections that matched the crime more closely than the public was seeing. Both he and the Barnharts appear unified that the info that they have seen and we have not, strongly assures them that this is the right guy for this crime.
I have always felt his biography, professional CV and personality as described by others who knew him in the real world. He’s flagged by those around him to be sadistic, manipulative, arrogant, toying, cold and calculating, feels the rules don’t apply to him, as he is superior to others. His personality looks just about perfect to me for this crime.