In my research, it was both but for different people. For some it was the outer hijab or face covering, whilst for others it was the hair covering. For eg, Sukayna daughter of Imam Hussain has her earrings snatched. This can only happen if the hijab was removed