Purpose of NSLOOKUP?

[mikehende]

I don't understand the purpose of this as explained in MM's book, can anyone please explain why you would use this tool? Thanks.

[rVidia]

From the book Computer Forensics: Incident Response Essentials:
In this age of pervasive connectivity, it is unrealistic to expect cyber crime incidents to be isolated to a single system. Like characters in a William Gibson novel, cyber sleuths often have to track offenders across the digital matrix. While the techniques of network forensics are still largely undeveloped, it would be a disservice to devote an entire book to computer forensics without any discussion of Internet methods that you can use to find leads to suspect computers.
...network tool that will be useful to you in tracking an offender is one that can be manually used to resolve a domain name. The classic tool for this purpose, nslookup, is available on Unix, Windows NT, and Windows 2000. You can use nslookup to perform both forward and reverse lookups, resolving the IP address associated with a specific host name or obtaining the name associated with a numeric address.
Mike, is this a better explanation of its purpose?

[mikehende]

Yes it is, thanks!

[Smokey]

There is much more you can do with nslookup then just forward and reverse lookups of standard A records. You can also set options to allow for all other record types to be returned. So if you have www.domain.com and there is obviously an A record but maybe there is also an MX record, you can set nslookup to return MX records instead and you will get those records returned instead of A records. That is just once example of things you can do with nslookup. http://support.microsoft.com/kb/200525/ has the option list online and it is also available in the application itself.