Anti-Forensics
Account Misuse
Audit Trail Saturation
Clear Browser Artifacts
Clear Email Artifacts
Code Contribution Obfuscation and Misrepresentation
Cross-System Activity Fragmentation
Decrease Privileges
Delayed Execution Triggers
Delete User Account
Deletion of Volume Shadow Copy
Disable Logging
Disk Wiping
File Deletion
File Encryption
Hide Artifacts
Hiding or Destroying Command History
Incremental Data Collection
Investigative Deception
Log Deletion
Log Modification
Message Deletion
Message Modification
Modify Windows Registry
Network Obfuscation
Parent Process ID Spoofing
Physical Destruction of Evidence
Physical Destruction of Storage Media
Physical Removal of Disk Storage
Retention Window Exploitation
Rootkit
Stalling
Steganography
System Shutdown
System Time Modification
Timestomping
Tripwires
Trusted Tool Misuse
Uninstalling Software
Virtualization
- ID: AF043.003
- Created: 07th November 2026
- Updated: 07th November 2026
- Contributor: The ITM Team
Physical Destruction of Paper Records
A subject deliberately destroys or materially damages paper records to prevent or hinder their examination or their use in establishing relevant events. The records may include original organizational documents, printed copies, handwritten notes, notebooks, correspondence, or paper-based transaction records. The subject may perform the destruction directly or arrange for another person or service to carry it out, including by introducing relevant records into an otherwise legitimate disposal process.
The behavior includes destruction of complete records or selected portions containing relevant information. It may occur before an investigation begins or after the subject becomes aware of scrutiny. Complete destruction or successful prevention of recovery is not required. Classification requires evidence that the destruction was intended to conceal relevant activity or frustrate investigation; routine authorized disposal, accidental damage, or an unexplained missing record does not independently establish the behavior.