An improved protocol for the examination of rogue WWW sites

Internet server managers have a range of techniques available to help them improve service performance and security. These techniques can become barriers to the investigation of illicit or illegal activity. This paper describes some of the legitimate techniques which can be used to improve server performance or security, and which present challenges for the investigator. Furthermore, it proposes a rigorous procedure which should be followed to ensure that any investigation of a web site or server has been complete and accurate, and that all possible useful information has been extracted and examined.