Page 1

DOMAIN & HOSTING EVIDENCE · A GUIDE FOR UK LAWYERS Domain, DNS and Hosting Records Who Is Behind a Website, and How Its Infrastructure History Is Proved COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM REGISTRANT UNMASKING CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the address book of the internet 03 The record layers: registration, DNS, hosting and certificates 04 Unmasking: from redacted WHOIS to a named registrant 05 Reconstructing history: what the domain did and when 06 Email authentication: SPF, DKIM, DMARC and spoofing disputes 07 Remedies and process: registrars, hosts, Nominet and the courts 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: PUBLICINFRASTRUCTURERECORDSNARROWTHEFIELD; REGISTRARANDHOSTDISCLOSURENAMESTHEHAND: ANDTHEHISTORYISARCHIVED EVENWHENTHESITEISGONE

§ 02 · FIRST PRINCIPLES The problem in plain English: the address book of the internet

§ 03 · THELAYERS The record layers: registration, DNS, hosting and certificates