Anti-Forensics
Account Misuse
Clear Browser Artifacts
Clear Email Artifacts
Decrease Privileges
Delayed Execution Triggers
Delete User Account
Deletion of Volume Shadow Copy
Disk Wiping
File Deletion
File Encryption
Hide Artifacts
Hiding or Destroying Command History
Log Deletion
Log Modification
Modify Windows Registry
Network Obfuscation
Physical Destruction of Storage Media
Physical Removal of Disk Storage
Stalling
Steganography
System Shutdown
Timestomping
Tripwires
Uninstalling Software
Virtualization
Windows System Time Modification
- ID: AF028.003
- Created: 06th October 2025
- Updated: 08th October 2025
- Contributor: The ITM Team
Lack of Communication
The subject avoids or delays engagement with the investigation by failing to respond to formal communication attempts. This anti-forensic behavior manifests as ignored meeting requests, prolonged email silence, delayed replies to HR or Legal correspondence, or refusal to engage in scheduled discussions. In more sophisticated cases, the subject may cite external justifications, such as stress, workload, or active legal consultation, to defer interaction without outright refusal.
These behaviors often emerge once the subject becomes aware of investigative scrutiny or anticipates disciplinary action. While not overtly obstructive in isolation, the cumulative impact of sustained communication avoidance can materially hinder the investigation’s pace and prevent timely evidence preservation, containment, or escalation.
This tactic is particularly effective in organizations where procedural deference, wellness accommodations, or interdepartmental dependencies limit the ability to enforce timely cooperation. Investigators should treat communication silence, especially when it follows a triggering event, as a potential indicator of an anti-forensic strategy and escalate accordingly.