Faraday Isolation
Definition
Shielding a mobile device from radio frequency signals (cellular, Wi-Fi, Bluetooth, GPS) using a Faraday bag or cage, preventing network connections that could alter data or trigger a remote wipe during seizure and transport.
- Function
- Shields a mobile device from cellular, Wi-Fi, Bluetooth, GPS
- Purpose
- Prevents network-triggered data alteration or remote wipe
- Equipment
- Faraday bag or Faraday cage/chamber
- Timing
- Applied at seizure, maintained through transport
Common questions
How is Faraday isolation different from simply turning the phone off?+
Powering a device off can trigger encryption lockouts or lose volatile data such as an unlocked state, open apps, or RAM contents. Faraday isolation keeps the device powered and usable for forensic capture while still cutting it off from any network that could alter or wipe its data.
What has to be verified before relying on a Faraday bag or cage?+
The enclosure's shielding effectiveness has to be checked against the frequencies in use, since a degraded bag, a poor seal, or a chamber door left open can let a signal through; agencies periodically test enclosures with a phone and a call or ping attempt to confirm they still block connectivity.
Related terms
- Chain of Custody
- The documented chronological record of who collected, handled, transferred, and examined a piece of evidence. For digital evidence, chain of custody includes...
- Logical Acquisition
- An extraction method that uses the device's own operating system interfaces, such as iTunes backup or Android Debug Bridge, to export the...
- Packet Capture (PCAP)
- The interception and recording of network packets as they traverse an interface. The raw data is stored in PCAP format and analysed...
- Physical Acquisition
- An extraction method that reads the raw flash storage of a mobile device, bypassing the operating system. Produces a bit-for-bit image of...
- Write Blocker
- A hardware or software device interposed between a digital storage medium and the forensic workstation that prevents any write commands from reaching...