Airplane Mode, Pres...
 
Notifications
Clear all

Airplane Mode, Preserving evidence

Cashie88
(@cashie88)
New Member

A policeman seizes a mobile phone and puts it on airplane mode to preserve the evidence.

On the same phone, facebook and messanger are downloaded and active when phone is seized.

Months later the owner of said phone decides to delete their facebook, messanger etc off a different device. 

When you delete facebook it will remotely log you out of every device.

Does this log the account out on the phone that has been preserved by airplane mode? 

When an examiner goes to investigate the phone will he/she find that all evidence pertaining to that account is now lost? Or wil it still be preserved?

Quote
Topic starter Posted : 07/08/2021 11:21 am
Plan_B
(@plan_b)
Junior Member

Data that was on the smartphone usually remains on it as long as flight mode is active.

However, if the forensic expert decides to deactivate the flight mode, the applications synchronize and access to the apps and their data is lost.

ReplyQuote
Posted : 09/08/2021 12:14 pm
jaclaz
(@jaclaz)
Community Legend
Posted by: @plan_b

However, if the forensic expert decides to deactivate the flight mode, the applications synchronize and access to the apps and their data is lost.

Faraday cage anyone?

jaclaz

ReplyQuote
Posted : 10/08/2021 9:18 am
Plan_B
(@plan_b)
Junior Member

@jaclaz 

 

I have already needed an active network connection in many cases to fully access data. Be it through two-factor authentication or simply downloading my own data (Facebook, Google, etc). Unfortunately, the Faraday bag doesn't help me there either 🙂

 

The fact that this is not forensically sound may be overlooked. In the fight against crime, you have to go "over dead bodies" now and then.

 

Greets

PlanB

This post was modified 2 months ago 2 times by Plan_B
ReplyQuote
Posted : 12/08/2021 9:19 am
jaclaz
(@jaclaz)
Community Legend
Posted by: @plan_b

I have already needed an active network connection in many cases to fully access data. Be it through two-factor authentication or simply downloading my own data (Facebook, Google, etc). Unfortunately, the Faraday bag doesn't help me there either 🙂

Sure, I was trying to say something different.

There are AFAIK three "possible states" of a smartphone:

1) Airplane mode
2) "normal" inside a (good) Faraday cage (i.e. with no connection to the outside world)
3) "normal" (with connection be it via Wi-Fi or SIM/cellular network)

It is entirely possible that *something* can be done in state #2 that cannot be done in state #1, before going to state #3.

jaclaz

 

ReplyQuote
Posted : 12/08/2021 10:03 am
Plan_B liked
Plan_B
(@plan_b)
Junior Member

@jaclaz 

That is of course correct!

Had misunderstood your message.

 

 

Thanks and greetings

P

ReplyQuote
Posted : 12/08/2021 11:36 am
Share: