Domain DNS And Hosting Records

DOMAIN & HOSTINGEVIDENCE · AGUIDEFORUKLAWYERS Domain, DNS and Hosting Records Who Is Behind a Website, and How Its Infrastructure History Is Proved COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM REGISTRANT UNMASKING CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the address book of the internet 03 The record layers: registration, DNS, hosting and certificates 04 Unmasking: from redacted WHOIS to a named registrant 05 Reconstructing history: what the domain did and when 06 Email authentication: SPF, DKIM, DMARC and spoofing disputes 07 Remedies and process: registrars, hosts, Nominet and the courts 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : PUBLICINFRASTRUCTURERECORDSNARROWTHEFIELD ; REGISTRARANDHOSTDISCLOSURENAMESTHEHAND : ANDTHEHISTORYISARCHIVED EVENWHENTHESITEISGONE § 0 2 · FIRSTPRINCIPLES The problem in plain English: the address book of the internet § 0 3 · THELAYERS The record layers: registration, DNS, hosting and certificates § 0 4 · THESEQUENCE Unmasking: from redacted WHOIS to a named registrant § 0 5 · THEPAST Reconstructing history: what the domain did and when § 0 6 · THEMAILQUESTION Email authentication: SPF, DKIM, DMARC and spoofing disputes § 0 7 · GETTINGITSTOPPED , GETTINGITNAMED Remedies and process: registrars, hosts, Nominet and the courts § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE RECORDS HOST PUBLIC REGISTRAR / (LIVE) ACCOUNTS THIRD-PART Y PAYMENT VICTIM-SIDE DELETED / ARCHIVES LAYER RECORDS RECOVERABLE § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THESUPPLIERELEVENDAYSOLD EXAMPLE2 · THE " COMPETITOR " REVIEWSITE EXAMPLE3 · THEDOMAINTHATCHANGEDHANDSMID - DISPUTE § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · INFRASTRUCTURELIMBFORTHEPRESER VAT IONLETTER § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The infrastructure checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions WHOIS shows the registrant as "REDACTED FOR PRIVACY". Dead end? The fraudulent site has already been taken down. Have we lost the evidence? Can we find every domain a wrongdoer operates? An email claims to be from our client's domain. How do we prove it was not? Is a Norwich Pharmacal order really available against a registrar or payment processor? Should our client publish DMARC even if it is the victim here? § 1 4 · REFERENCE Glossary DMARC DKIM RDAP SPF UDRP Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY