Domain name forensics: a systematic approach to investigating an internet presence

Over the last few years the typical Internet presence has become a crowded outsourcing arrangement of multiple organizations dividing up the complexity of maintaining various parts of an infrastructure. Finding the parties responsible for the different infrastructure areas has become time consuming and error prone. This paper presents a systematic approach to investigating a complex Internet presence, including collecting, time-stamping, packaging, preserving, and presenting evidence. It is geared towards the network forensics practitioner.