WDH-078 Websites, Domains & Internet Infrastructure
What should I do if the website disappears?¶
Preserve the current state, reconstruct historic content and trace the provider and account records. The public page may be gone while the evidential trail remains.
Evidence to consider¶
- current DNS, errors and redirects;
- existing screenshots and downloads;
- web archives and previews;
- provider account and configuration records;
- backups or deleted content;
- browser history and cached material;
- timeline of disappearance.
Interpret the result carefully¶
Technical records may identify a service, account, device or request rather than the person responsible. Preserve exact dates, times and time zones, and test shared access, automation, compromise and changing infrastructure where relevant.
Key takeaway
Treat disappearance as an event to investigate, not proof that the evidence has been lost.