Page 1
DOMAIN & HOSTING EVIDENCE · A GUIDE FOR UK LAWYERS Domain, DNS and Hosting Records Who Is Behind a Website, and How Its Infrastructure History Is Proved COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM REGISTRANT UNMASKING CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the address book of the internet 03 The record layers: registration, DNS, hosting and certificates 04 Unmasking: from redacted WHOIS to a named registrant 05 Reconstructing history: what the domain did and when 06 Email authentication: SPF, DKIM, DMARC and spoofing disputes 07 Remedies and process: registrars, hosts, Nominet and the courts 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: PUBLICINFRASTRUCTURERECORDSNARROWTHEFIELD; REGISTRARANDHOSTDISCLOSURENAMESTHEHAND: ANDTHEHISTORYISARCHIVED EVENWHENTHESITEISGONE
§ 02 · FIRST PRINCIPLES The problem in plain English: the address book of the internet
§ 03 · THELAYERS The record layers: registration, DNS, hosting and certificates
Page 2
§ 04 · THESEQUENCE Unmasking: from redacted WHOIS to a named registrant
§ 05 · THEPAST Reconstructing history: what the domain did and when
§ 06 · THEMAILQUESTION Email authentication: SPF, DKIM, DMARC and spoofing disputes
§ 07 · GETTINGITSTOPPED, GETTINGITNAMED Remedies and process: registrars, hosts, Nominet and the courts
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE RECORDS HOST PUBLIC REGISTRAR / (LIVE) ACCOUNTS THIRD-PART Y PAYMENT VICTIM-SIDE DELETED / ARCHIVES LAYER RECORDS RECOVERABLE
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THESUPPLIERELEVENDAYSOLD EXAMPLE2 · THE " COMPETITOR " REVIEW SITE EXAMPLE3 · THEDOMAINTHATCHANGEDHANDSMID - DISPUTE
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INFRASTRUCTURELIMBFORTHEPRESER VAT I ON LETTER
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The infrastructure checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions WHOIS shows the registrant as "REDACTED FOR PRIVACY". Dead end? The fraudulent site has already been taken down. Have we lost the evidence? Can we find every domain a wrongdoer operates? An email claims to be from our client's domain. How do we prove it was not? Is a Norwich Pharmacal order really available against a registrar or payment process or? Should our client publish DMARC even if it is the victim here?
§ 14 · REFERENCE Glossary DMARC DKIM RDAP SPF UDRP Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Domain DNS And Hosting Records, Computer Forensics Lab, https://e-discovery.uk/library/domain-dns-and-hosting-records/pdf.