Perpetrators utilize different network reconnaissance techniques in order to discover vulnerabilities and conduct their attacks. Port scanning can be leveraged to conclude open ports, available services, and even running operating systems along with their versions. Even though these techniques are effective, their aggressiveness for information gain could leave an apparent sign of attack, which can be observed by the variety of security controls deployed at the network perimeter of an organization. However, not all such attacks can be stopped nor the corresponding security controls can defend against insiders. In this paper, we tackle the problem of reconnaissance detection using a different approach. We utilize the rich information that is kept in memory (or RAM). We observe that packets sent or received stay in memory for a while. Our results show that inspecting memory for attack signs is beneficial. Furthermore, correlating contents that are obtained from different memories empowers the investigation process and helps reach to conclusions.

Digital forensics is an evolving discipline that looks for evidence in electronic devices. It is being utilised in investigating attacks and accusing cyber criminals. As in physical crimes, a cyber criminal might try every possible technique to hide responsibility about a crime. This can be done by manipulating all kinds of traces that could lead investigators to resolve cases. For example, a criminal can delete files, images, network traces, operating system log files, or browsing history. An easy procedure a criminal might follow to conceal crime activities are: 1) create a new user account; 2) commit a crime through the just-created account; 3) delete the account along with all files and directories that belong to it. To counter this kind of anti-forensic actions, this paper collects evidence from deleted user accounts. We seek artefacts in windows event logs, registry hives, RAM, Pagefile, and hard drive. Interestingly, this paper shows that several clues about deleted accounts can be harvested. To the best of our knowledge, we are the first to tackle such a problem.