WDH-038 Websites, Domains & Internet Infrastructure
Who published the content on the website?¶
Identify the publishing mechanism, the account used and the person linked to that account. Domain registration or website ownership does not automatically prove who uploaded the material.
Content may have been published by a business owner, developer, employee, marketplace user, contractor or attacker using a compromised account.
Identify where the content sits¶
Establish whether it is:
- part of the main site;
- a user profile or seller page;
- a blog post;
- an uploaded file;
- a database-generated page; or
- content delivered through another service.
This helps identify which provider and records matter.
Look for publishing records¶
Relevant evidence may include:
- platform publishing history;
- content-management logs;
- administrator actions;
- timestamps;
- host or system access records;
- drafts, messages or instructions;
- local files; and
- devices linked to the publishing account.
A record showing that an account published the content identifies the account action, not automatically the person behind it.
Key takeaway
Attribute publication through the account, access and device evidence connected to the specific content and relevant time.