Anti-Forensics
Account Misuse
Audit Trail Saturation
CCTV Surveillance Evasion
Clear Browser Artifacts
Clear Email Artifacts
Code Contribution Obfuscation and Misrepresentation
Cross-System Activity Fragmentation
Decrease Privileges
Delayed Execution Triggers
Delete User Account
Deletion of Volume Shadow Copy
Disable Logging
Disk Wiping
File Deletion
File Encryption
Hide Artifacts
Hiding or Destroying Command History
Incremental Data Collection
Investigative Deception
Log Deletion
Log Modification
Message Deletion
Message Modification
Modify Windows Registry
Network Obfuscation
Notification Suppression
Parent Process ID Spoofing
Physical Destruction of Evidence
Physical Identity Concealment
Physical Removal of Disk Storage
Retention Window Exploitation
Rootkit
Stalling
Steganography
System Shutdown
System Time Modification
Timestomping
Tripwires
Trusted Tool Misuse
Uninstalling Software
Virtualization
- ID: AF045
- Created: 15th November 2026
- Updated: 15th November 2026
- Contributor: The ITM Team
Physical Identity Concealment
A subject deliberately conceals or alters their physical appearance to prevent or hinder identification through visual surveillance or subsequent forensic examination. This may involve wearing masks, face coverings, hoods, or other clothing and accessories intended to obscure distinguishing facial or physical characteristics.
The subject may employ these measures while committing an infringement, such as theft, physical sabotage, or unauthorized entry into restricted areas, to reduce the likelihood of being identified in CCTV footage, photographs, or eyewitness accounts.
The defining characteristic is the deliberate concealment of the subject's identity to frustrate attribution or subsequent investigation. The use of face coverings or changes in appearance alone does not establish anti-forensic intent, which should be assessed against the surrounding circumstances and available evidence.