Airplane Mode, Pres...
 
Notifications
Clear all

Airplane Mode, Preserving evidence

6 Posts
3 Users
1 Likes
4,577 Views
(@cashie88)
Posts: 1
New Member
Topic starter
 

A policeman seizes a mobile phone and puts it on airplane mode to preserve the evidence.

On the same phone, facebook and messanger are downloaded and active when phone is seized.

Months later the owner of said phone decides to delete their facebook, messanger etc off a different device. 

When you delete facebook it will remotely log you out of every device.

Does this log the account out on the phone that has been preserved by airplane mode? 

When an examiner goes to investigate the phone will he/she find that all evidence pertaining to that account is now lost? Or wil it still be preserved?

 
Posted : 07/08/2021 10:21 am
(@plan_b)
Posts: 31
Eminent Member
 

Data that was on the smartphone usually remains on it as long as flight mode is active.

However, if the forensic expert decides to deactivate the flight mode, the applications synchronize and access to the apps and their data is lost.

 
Posted : 09/08/2021 11:14 am
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 
Posted by: @plan_b

However, if the forensic expert decides to deactivate the flight mode, the applications synchronize and access to the apps and their data is lost.

Faraday cage anyone?

jaclaz

 
Posted : 10/08/2021 8:18 am
(@plan_b)
Posts: 31
Eminent Member
 

@jaclaz 

 

I have already needed an active network connection in many cases to fully access data. Be it through two-factor authentication or simply downloading my own data (Facebook, Google, etc). Unfortunately, the Faraday bag doesn't help me there either 🙂

 

The fact that this is not forensically sound may be overlooked. In the fight against crime, you have to go "over dead bodies" now and then.

 

Greets

PlanB

This post was modified 3 years ago 2 times by Plan_B
 
Posted : 12/08/2021 8:19 am
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 
Posted by: @plan_b

I have already needed an active network connection in many cases to fully access data. Be it through two-factor authentication or simply downloading my own data (Facebook, Google, etc). Unfortunately, the Faraday bag doesn't help me there either 🙂

Sure, I was trying to say something different.

There are AFAIK three "possible states" of a smartphone:

1) Airplane mode
2) "normal" inside a (good) Faraday cage (i.e. with no connection to the outside world)
3) "normal" (with connection be it via Wi-Fi or SIM/cellular network)

It is entirely possible that *something* can be done in state #2 that cannot be done in state #1, before going to state #3.

jaclaz

 

 
Posted : 12/08/2021 9:03 am
Plan_B reacted
(@plan_b)
Posts: 31
Eminent Member
 

@jaclaz 

That is of course correct!

Had misunderstood your message.

 

 

Thanks and greetings

P

 
Posted : 12/08/2021 10:36 am
Share: