Method and System for forensic investigation of internet resources

摘要

The present invention involves a Method and System for a forensic investigation of internet resources (IP addresses, e-mail addresses, website addresses, SSL certificates, routing table lines etc.) in order to reveal relations, dependencies and connections between these internet resources. Starting from a given internet resource, a set of examinations is performed (name server queries, Whois information lookups, initiating a connection using various protocols etc.) to retrieve background information and related internet resources. The examinations are performed recursively on the related internet resources until relevant information is found, typically contact information of a person or company owning, managing or operating an internet resource. All results are displayed in a hierarchical tree view. The invention supports investigations where the origin of internet communication (e.g. e-mail) must be determined. The invention also supports investigations where the origin, owner and location of content published on the internet must be established or where the origin of a hacking attempt or unauthorized access to a system must be determined.