Forensic artefacts associated with intentionally deleted user accounts
by Mohammed I. Al-Saleh; Mona J. Al-Shamaileh
International Journal of Electronic Security and Digital Forensics (IJESDF), Vol. 9, No. 2, 2017

Abstract: Digital forensics is an evolving discipline that looks for evidence in electronic devices. It is being utilised in investigating attacks and accusing cyber criminals. As in physical crimes, a cyber criminal might try every possible technique to hide responsibility about a crime. This can be done by manipulating all kinds of traces that could lead investigators to resolve cases. For example, a criminal can delete files, images, network traces, operating system log files, or browsing history. An easy procedure a criminal might follow to conceal crime activities are: 1) create a new user account; 2) commit a crime through the just-created account; 3) delete the account along with all files and directories that belong to it. To counter this kind of anti-forensic actions, this paper collects evidence from deleted user accounts. We seek artefacts in windows event logs, registry hives, RAM, Pagefile, and hard drive. Interestingly, this paper shows that several clues about deleted accounts can be harvested. To the best of our knowledge, we are the first to tackle such a problem.

Online publication date: Sun, 30-Apr-2017

The full text of this article is only available to individual subscribers or to users at subscribing institutions.

 
Existing subscribers:
Go to Inderscience Online Journals to access the Full Text of this article.

Pay per view:
If you are not a subscriber and you just want to read the full contents of this article, buy online access here.

Complimentary Subscribers, Editors or Members of the Editorial Board of the International Journal of Electronic Security and Digital Forensics (IJESDF):
Login with your Inderscience username and password:

Username:        Password:          Forgotten your password?

Want to subscribe?
A subscription gives you complete access to all articles in the current issue, as well as to all articles in the previous three years (where applicable). See our Orders page to subscribe.

If you still need assistance, please email subs@inderscience.com