Anti-Forensics
Account Misuse
Audit Trail Saturation
Clear Browser Artifacts
Clear Email Artifacts
Code Contribution Obfuscation and Misrepresentation
Cross-System Activity Fragmentation
Decrease Privileges
Delayed Execution Triggers
Delete User Account
Deletion of Volume Shadow Copy
Disable Logging
Disk Wiping
File Deletion
File Encryption
Hide Artifacts
Hiding or Destroying Command History
Incremental Data Collection
Investigative Deception
Log Deletion
Log Modification
Message Deletion
Message Modification
Modify Windows Registry
Network Obfuscation
Parent Process ID Spoofing
Physical Destruction of Evidence
Physical Destruction of Storage Media
Physical Removal of Disk Storage
Retention Window Exploitation
Rootkit
Stalling
Steganography
System Shutdown
System Time Modification
Timestomping
Tripwires
Trusted Tool Misuse
Uninstalling Software
Virtualization
- ID: AF043.004
- Created: 07th November 2026
- Updated: 07th November 2026
- Contributor: The ITM Team
Physical Destruction of Electronic Devices
A subject deliberately destroys or materially damages an electronic device to prevent or hinder its examination or the recovery of information relevant to the subject’s activity. The behavior may target organizational or personally owned laptops, desktop computers, smartphones, tablets, recording devices, or other electronic equipment used in the relevant activity. The subject may perform the destruction directly or arrange for another person or service to carry it out.
This Sub-section concerns destruction directed at the device as a complete item, rather than a separately targeted storage component. The damage may impair access to information without rendering every component unusable, and successful prevention of recovery is not required. Classification requires evidence connecting the damage to an intention to conceal relevant activity or frustrate investigation. Accidental damage, ordinary hardware failure, authorized disposal, or loss of device connectivity does not independently establish the behavior.