Physical Destruction of Evidence

A subject may destroy or otherwise impair physical disk storage, such as hard disk drives or solid-state drives, to deny access to the files and artifacts stored on them.

A subject deliberately destroys or materially damages an electronic device to prevent or hinder its examination or the recovery of information relevant to the subject’s activity. The behavior may target organizational or personally owned laptops, desktop computers, smartphones, tablets, recording devices, or other electronic equipment used in the relevant activity. The subject may perform the destruction directly or arrange for another person or service to carry it out.

This Sub-section concerns destruction directed at the device as a complete item, rather than a separately targeted storage component. The damage may impair access to information without rendering every component unusable, and successful prevention of recovery is not required. Classification requires evidence connecting the damage to an intention to conceal relevant activity or frustrate investigation. Accidental damage, ordinary hardware failure, authorized disposal, or loss of device connectivity does not independently establish the behavior.

A subject deliberately destroys or materially damages paper records to prevent or hinder their examination or their use in establishing relevant events. The records may include original organizational documents, printed copies, handwritten notes, notebooks, correspondence, or paper-based transaction records. The subject may perform the destruction directly or arrange for another person or service to carry it out, including by introducing relevant records into an otherwise legitimate disposal process.

The behavior includes destruction of complete records or selected portions containing relevant information. It may occur before an investigation begins or after the subject becomes aware of scrutiny. Complete destruction or successful prevention of recovery is not required. Classification requires evidence that the destruction was intended to conceal relevant activity or frustrate investigation; routine authorized disposal, accidental damage, or an unexplained missing record does not independently establish the behavior.

A subject may destroy or otherwise impair removable storage media, such as external hard drives or USB sticks, to deny access to the files and artifacts stored on them.