Domain name forensics: a systematic approach to investigating an internet presence

• Authors: Bruce J. Nikkel
• Venue: Digital Investigation: The International Journal of Digital Forensics & Incident Response
• Year: 2004

Over the last few years the typical Internet presence has become a crowded outsourcing arrangement of multiple organizations dividing up the complexity of maintaining various parts of an infrastructure. Finding the parties responsible for the different infrastructure areas has become time consuming and error prone. This paper presents a systematic approach to investigating a complex Internet presence, including collecting, time-stamping, packaging, preserving, and presenting evidence. It is geared towards the network forensics practitioner.