Delete User Account

A subject deletes a cloud user account to conceal activity, disrupt attribution, remove access associations, interfere with an investigation, or remove information connected to the account. The deleted identity may be maintained within a cloud platform, cloud identity provider, or Software as a Service application and may include a member or guest account.

Deletion may be performed through an administration portal, command-line interface, Application Programming Interface (API), script, or automated identity-lifecycle workflow. Investigators should identify the initiating subject, target identity, deletion method, source address, privileged role used, approval record, and deletion time. They should also preserve and review the account’s prior authentication activity, group and role memberships, authentication methods, licenses, owned resources, mailbox or storage data, and recovery status. Cloud identity platforms retain audit records capable of identifying changes to users and other directory objects, while services such as AWS CloudTrail record account activity involving the creation, modification, or deletion of Identity and Access Management resources.

Routine account deletion performed through an authorized offboarding or identity-governance process should not be classified as anti-forensic activity. Classification should require evidence that the deletion was unauthorized, concealed, inconsistent with the approved lifecycle process, or intended to frustrate attribution or preservation.

A subject deletes a local Linux user account using account management utilities such as userdel to obscure activity associated with that identity. The deletion removes account entries from local identity databases, such as /etc/passwd and /etc/shadow, and may include removal of the subject's home directory and associated files, reducing available forensic evidence.

A subject deletes a local macOS user account through System Settings or directory management utilities such as dscl to obscure activity associated with that identity. Deletion removes the account from the local directory service and may include removal of the associated home directory, potentially eliminating files and artifacts relevant to a subsequent investigation.

A subject deletes a local Windows user account through administrative tools or commands to obscure activity associated with that identity. Deletion removes the account from the local Security Account Manager (SAM) database and may be accompanied by removal of the associated user profile and files, hindering subsequent attribution and forensic examination.

A subject deletes a user account from Windows Active Directory to obscure activity associated with the domain identity or interfere with an investigation. Deletion removes the account from the Active Directory namespace, potentially complicating the reconstruction of authentication activity, group memberships, and historical access permissions.