Why group by discipline at all
The category split on this site — consulting on one side, expert witness and investigations on the other — describes how work is bought. It does not describe where the knowledge comes from. Grouping by discipline does, and it is the more honest map if you are trying to judge whether somebody knows the subject or has merely listed it.
The three groupings are not equal in size and they are not meant to be. Search is the oldest and the broadest. Domain names is the narrowest and the most technical. Legal and investigative work is the newest of the three as a named practice, and it draws almost entirely on the other two.
Search
Search engine optimization is the practice of making a website into an answer a search engine is willing to give. That is a narrower job than it sounds and a more technical one than most descriptions admit. A search engine has to reach a page, work out what it is about, decide it is a better response to a particular query than the alternatives, and be reasonably confident the source is trustworthy. Every tactic anyone has ever sold as SEO is an attempt to influence one of those four things.
I have been practicing since 1996, which is long enough to have watched the field acquire and then quietly shed a great many theories. Directory submissions stopped mattering. Meta keyword tags stopped mattering. Keyword-stuffed doorway pages stopped working and then started attracting penalties. Purchased links moved from a standard tactic to a liability. Exact match domains lost most of their inherent advantage. Mobile rendering became the primary way pages are evaluated rather than a secondary consideration.
What did not change is more useful to hold on to. A page a crawler cannot reach still cannot rank. Duplicate content still splits signals between URLs that should be one URL. An endorsement from a genuinely independent site is still worth more than a hundred from sites that endorse everyone. And anything cheap, scalable and available to everybody is on a timer, because the value of a signal is inversely proportional to how easily it can be manufactured.
Domain names
A domain name is infrastructure that most organisations treat as branding. It has a registrar account with its own access control, a set of DNS records that determine where the traffic and the mail actually go, an expiry date, a transfer lock, and a history that predates the current owner. Every one of those has taken a business offline somewhere.
The work in this discipline runs from the strategic — which name, which extension, how a portfolio should be structured, what a name's past use means for what you can do with it — to the forensic, when a name has been taken and the question is how it moved and how to move it back. In 2013 I created an algorithm and a patent-pending process for performing a background check on a domain name, precisely because the history of a name is knowable and almost nobody checks it before spending real money.
This is also the discipline with the most public infrastructure to learn: the domain name system itself, the WHOIS and registration data services that record who holds a name, the coordinating role of ICANN, and the Uniform Domain-Name Dispute-Resolution Policy that governs one narrow class of dispute — and, importantly, does not govern theft, which is a different problem with a different remedy.
Legal and investigative
This is work performed for attorneys and for parties to a dispute. It draws on the other two disciplines and adds a different standard: everything has to be reproducible, everything has to be sourced to preserved primary data, and every conclusion has to carry its evidentiary basis where an opposing expert can examine it.
The investigative half establishes attribution and history — who is behind a site, when something was published, how properties are connected — from registration records, DNS, hosting, archives and platform exports. The expert witness half turns that into a written analysis and opinion, with its limits stated explicitly, for a reader who is not a technologist and should not have to be.
No named case, court, docket or testimony appears anywhere on this site. Expert engagements are frequently confidential, and describing the practice rather than the matters is both the correct and the only defensible option.
How the three fit together
They are three views of the same object. A domain name dispute is a search problem when the harm is measured in traffic and a domain problem when the question is who held the name. A migration is a search project with a domain component at its centre. An investigation into who is behind a network of sites is a domain exercise that produces search evidence. Practising all three is not breadth for its own sake — it is what makes it possible to answer the question a client actually has rather than the part of it that fits one specialism.