Backtracing a dead page?

[Tryska]

So here's a hypothetical question.


Say someone owned a website that they weren't supposed to own, a possible "commercial" website. Now when the sh*t hits the fan, this person shuts down all their websites.


Is there still a trace of it somewhere? would it be possible to find who was trafficking those websites, and possibly a customer list or soemthing of that sort?


and i'm asking out of otal curioisty, because i always thought, no matter what you do, bits ad bytes and fragments always get left behind.

[phishphreek]

There are plenty of thing to help you "backtrack".

Check out google's cache, http://www.google.com/help/features.html#cached

Then check out the cache of anything that site had registered in google using the

"inurl:www.website.com"

Using those search terms, you'll come up with something like
http://www.google.com/search?hl=en&l...22&btnG=Search

See how many pages are actually in cache

Check out archive.org's wayback machine http://www.archive.org/

Check whoever registered the domain name(whois) http://www.samspade.org

You can even check the uptime and server it was running http://news.netcraft.com/

If you can get access to a machine that has visited the site.. its possible that there are still files from the site, along with internet history in cache. If they've deleted cache... then it may be possible to recover it using a file recovery program. That is, if the files were not shredded beyond recovery, overwritten, etc.
I'm sure there are more, but thats what I've come up with off the top of my head.

[Tryska]

oh i should have mentioned...all of that's been used.


what's really needed i guess is figuring out who hit the pages on the now disappeared domain, and when. But i guess that depends on where the server is located, huh?

[phishphreek]

Originally posted here by Tryska
what's really needed i guess is figuring out who hit the pages on the now disappeared domain, and when. But i guess that depends on where the server is located, huh?

I'm a bit confused by this...

You want to find out who visited that domain which is no longer there?

If so, you'll need to get access to that webserver's logs. If they are gone... then you'll have to get the information from an ISP. Good luck! Plus... to get that info from a ISP... you'll have to have authorization... court order, warrant, etc.

You want to find out who ran the domain? Find out who the host was... then get them to tell you. Again... Unless you are law enforcement... then good luck.

[Tryska]

okay, so the host for the domain would be able to get the webserver logs.


i'm presuming that it would be the same deal (warrant) in order to find out who paid for services off those sites, eh?

interesting. and thanks for the info!

[XTC46]

very specific for a hypothetical question, especially sine you tryed those other things already.

[Tryska]

well hypothetical in that i'm watching things unfold on a specific situation.....namely this one.

http://news.yahoo.com/news?tmpl=stor...reporter_quits


and i've been watching people finding this guys bits and bytes all over the place, but was wondering if they could find his client lists.


cuz something tells me that would be like a whole new Watergate.