Wi-Fi Forensics

Wi-Fi forensics recovers evidence from wireless network logs, device association records, and 802.11 packet captures to place a device or person at a specific location and time. This topic covers access-point logs, probe request histories, packet-level 802.11 frame analysis, and the investigative tools used to extract and interpret that evidence.

Last updated: 24 Jun 2026

Wi-Fi forensics is the discipline of collecting, preserving, and interpreting evidence generated by IEEE 802.11 wireless networks to answer investigative questions about device location, user activity, and network events. The evidence exists in three primary forms: logs held by access points or network infrastructure, artefacts stored on the client device itself, and raw 802.11 frames captured from the air. Each form can independently corroborate or contradict a suspect's account of their location and activity, and the three forms are most powerful when analysed together.

Access points generate timestamped association and authentication records every time a device joins or leaves the network. The client device stores preferred network lists, connection timestamps, and in many operating systems a history of networks it has probed for. Over the air, a device broadcasting probe request frames reveals its MAC address and the SSIDs of networks it has previously joined, even when it has not yet connected to anything. A packet capture collected at the right location and time can contain all of this in plaintext 802.11 management frames.

The evidential value of Wi-Fi data rests on its ability to place a device, and by extension a person, at a specific location and time. Location attribution is not automatic: Wi-Fi range varies from a few metres to several hundred metres depending on the environment and antenna configuration, so placing a device within radio range of a particular access point is a different claim from placing it at a precise address. Investigators must understand radio propagation, device behaviour, and the limits of each evidence type before drawing location conclusions that will survive cross-examination.

By the end of this topic you will be able to:

Identify the forensic artefacts generated by Wi-Fi networks at the access point, on the client device, and in over-the-air packet captures.
Explain what information a probe request frame contains and how it can be used to demonstrate device presence at a location.
Describe where Wi-Fi association history is stored on Android, iOS, and Windows devices and the acquisition methods required to retrieve it.
Assess the impact of MAC address randomisation on Wi-Fi-based location attribution and identify workarounds available to investigators.
Apply the correct tools and chain-of-custody procedures for conducting an 802.11 monitor-mode packet capture in a forensic investigation.

Key terms

Probe request: An 802.11 management frame broadcast by a client device when actively scanning for Wi-Fi networks. Contains the device MAC address and, in many implementations, the SSIDs of previously joined networks. Captured in plaintext by any monitor-mode receiver in range.
BSSID: Basic Service Set Identifier. The MAC address of a specific access point radio. Used in association logs and packet captures to uniquely identify which physical access point a device connected to, distinct from the SSID (network name) which may be shared by multiple access points.
RSSI: Received Signal Strength Indicator. A value, typically expressed in dBm, recorded in access-point logs and packet captures that indicates how strongly a client's signal was received. Used to estimate proximity and to support or refute a device's claimed distance from an access point.
Monitor mode: A wireless adapter operating mode in which the adapter captures all 802.11 frames on a channel regardless of their source or destination, without joining any network. Required for forensic packet capture of probe requests, beacon frames, and over-the-air data traffic.
Preferred Network List (PNL): The list of previously joined Wi-Fi networks stored on a client device. The device automatically probes for networks on the PNL when scanning. Recovered from device storage during acquisition, the PNL reveals a history of networks the device has joined and the locations associated with them.
MAC address randomisation: A privacy mechanism in modern operating systems that substitutes a randomly generated MAC address for the device's globally unique burned-in address during Wi-Fi scanning and connection. Present in Android 8+, iOS 14+, and Windows 10 v1903+. Complicates cross-network tracking but does not eliminate all device-linking artefacts.

802.11 frame types and their forensic relevance

The IEEE 802.11 standard defines three categories of frames: management frames, control frames, and data frames. Forensic investigators work primarily with management frames because they contain the metadata of network participation: who joined, when, from which device, and with what signal strength. Management frames are transmitted unencrypted on modern networks, including those using WPA2 and WPA3, with the exception of the 802.11w Protected Management Frames standard which encrypts deauthentication and disassociation frames on participating networks.

Frame type	Direction	Key forensic fields	Investigative use
Probe request	Client to broadcast	Source MAC, SSID list	Proves device presence; reveals past networks
Probe response	AP to client	BSSID, SSID, capabilities	Confirms AP identity and location
Beacon	AP to broadcast	BSSID, SSID, timestamp	Identifies APs active at capture time
Association request	Client to AP	Source MAC, SSID, capabilities	Shows intent to join a specific network
Authentication frame	Client to AP	Source MAC, auth algorithm	First step of WPA handshake; timestamps
Deauthentication	Either direction	Reason code, MACs	Marks end of session; can indicate attack

Data frames carry the actual network payload. On an encrypted network the payload is ciphertext, but the frame headers remain visible and contain the source and destination MAC addresses, the BSSID, and sequence numbers. Sequence number analysis can identify retransmissions, estimate data volumes, and detect frame injection attacks where an adversary inserts forged frames to disrupt a session or plant misleading evidence.

Access-point logs: content, location, and limitations

When a Wi-Fi client associates with an access point, the access point records the event. In enterprise deployments the log entry is forwarded by syslog or SNMP trap to a central SIEM or log management platform where it is retained according to organisational policy. A typical association log entry contains: the client MAC address, the SSID and BSSID, the event type (association, reassociation, or disassociation), a timestamp, the 802.11 authentication method, and the received signal strength (RSSI).

In enterprise wireless environments managed by controllers such as Cisco WLC, Aruba Mobility Controller, or Juniper Mist, every access point in the building streams events to the controller, which maintains a searchable event database. Law enforcement can obtain these records by legal process directed at the organisation, the ISP, or the building owner. The retention period is set by organisational policy and local law: the EU's GDPR does not specify a minimum retention for Wi-Fi logs but requires proportionality; India's Information Technology Act 2000 and the Information Technology (Intermediary Guidelines) Rules 2021 require certain service providers to retain logs for 180 days; US federal law under 18 U.S.C. requires providers to preserve records for 90 days on request.

Consumer-grade home routers, which account for a large share of the access points investigators encounter, typically do not log association events to persistent storage. They may maintain a small rolling buffer of DHCP leases or connection events in NVRAM that is lost on reboot. Where AP logs are absent, investigators rely on the ISP's RADIUS authentication records (the ISP authenticates the router to the network, not individual Wi-Fi clients), on DHCP lease logs held by the ISP or home router, or on the device-side artefacts described in the next section.

Device-side Wi-Fi artefacts: preferred networks, timestamps, and geolocation

Every major mobile and desktop operating system records Wi-Fi connection history in persistent storage. The depth and accessibility of that history varies by platform. Recovery requires physical or file-system acquisition in most cases, as these artefacts are not exposed through standard backups.

On Android devices, Wi-Fi configuration and history are stored in several locations depending on the Android version. From Android 9 onward, the primary configuration file is /data/misc/apexdata/com.android.wifi/WifiConfigStore.xml. Earlier versions used /data/misc/wifi/WifiConfigStore.xml or /data/wifi/bcm-wifi/wpa_supplicant.conf. These files contain the SSID, BSSID, frequency band, security type, and timestamps of each remembered network. The wpa_supplicant.conf format also records the order in which networks were prioritised. Recovery requires a physical acquisition or root access to the device file system. For acquisition methods, see Physical Acquisition Techniques.

On iOS, Wi-Fi configuration is stored in the keychain and in preference plists under /private/var/preferences/SystemConfiguration/com.apple.network.identification.plist and the related wifi.plist. iTunes and iCloud encrypted backups include these files. The knownNetworks.plist in particular records the SSID, BSSID, last join date, and channel for each remembered network. On Windows 10 and 11, WLAN profiles are stored in C:\ProgramData\Microsoft\Wlansvc\Profiles\Interfaces\ and the SYSTEM registry hive contains additional connection timestamps under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles. The ShimCache and SRUM database provide corroborating timestamps for Wi-Fi adapter activity.

Probe requests and over-the-air evidence collection

Probe requests are the most tactically useful category of Wi-Fi evidence for real-time or near-real-time surveillance, because they are broadcast in plaintext before a device has connected to any network. A device scanning for Wi-Fi will emit probe requests for each SSID on its preferred network list and may also send broadcast probe requests with a null SSID asking any access point to respond. Both are capturable by any 802.11 monitor-mode receiver within radio range.

A forensic packet capture for probe request evidence requires a Wi-Fi adapter capable of monitor mode, placed on the channel where the target device is expected to operate. Tools commonly used include airodump-ng from the Aircrack-ng suite, which writes a PCAP file with timestamps, and Wireshark with a monitor-mode adapter, which allows live frame inspection. The capture file is the primary exhibit and must be preserved with a cryptographic hash immediately after collection. Metadata required for chain of custody includes the capture device serial number, the adapter make, model and driver version, GPS coordinates of the capture position and time, and the channel configuration used.

Analysing a PCAP file for probe requests uses Wireshark display filters. The filter wlan.fc.type_subtype == 0x04 isolates probe request frames. Within those frames, the SSID parameter field (Tag 0) contains the requested network name, and the source address field contains the transmitting device's MAC address. If the device is using MAC randomisation, the locally administered bit (bit 1 of the first octet of the MAC) will be set to 1, indicating a random rather than burned-in address. This distinction is visible in the packet headers.

Correlating multiple probe captures from different locations allows triangulation. If a target device's MAC address appears in captures from three different sensors at overlapping times, the intersection of their radio ranges narrows the device's probable position. This technique is analogous to cell-tower triangulation and has been used in law enforcement operations in the UK, US, and EU. The legal basis for conducting such captures varies: in the UK it requires authorisation under the Investigatory Powers Act 2016; in the US it requires a warrant under the Fourth Amendment following the Carpenter v. United States (2018) decision on digital location evidence; in India it falls under provisions of the Bharatiya Nagarik Suraksha Sanhita 2023 governing interception.

MAC address randomisation: forensic implications and workarounds

MAC address randomisation is now the default behaviour on most consumer devices. Android 8 introduced per-network randomisation; iOS 14 extended it to include randomisation of probe request frames; Windows 10 v1903 added optional randomisation. From a forensics perspective, randomisation means that consecutive captures of the same device at different locations may show different source MAC addresses, preventing simple tracking across captures.

Several techniques remain available to investigators. First, the stable burned-in MAC is preserved in device-side artefacts even when randomisation is active, because the OS records the hardware address alongside the randomised one in configuration files. Physical acquisition of the device will recover the real MAC, which can then be cross-referenced against AP logs from before randomisation was introduced. Second, some randomisation implementations are deterministic per-network: the same device generates the same random MAC for the same SSID, so if the network SSID is known, the randomised MAC is consistent across sessions. Third, information elements beyond the MAC in probe request frames, such as the list of supported data rates, the 802.11 capability flags, and the vendor-specific elements included by the chipset driver, form a fingerprint that can persist even as the MAC changes. This technique is called probe request fingerprinting and has been demonstrated in academic research to re-identify devices with high accuracy despite randomisation.

Building the location narrative: correlating Wi-Fi evidence with other sources

Wi-Fi evidence rarely stands alone in a criminal investigation. Its strength comes from corroboration with other location and device evidence. The AP log places a MAC address at a network at a time. The device's own preferred network list and connection timestamps confirm that the same device was the source. DHCP logs assign an IP address to that MAC, which links to any network-layer activity on the network such as web browsing, cloud service authentication, or file transfers logged by the network.

Cell tower data and GPS logs from the device provide independent location evidence that can confirm or contradict the Wi-Fi evidence. Location history from Google or Apple services, if obtained under legal process, maps BSSID observations to geographic coordinates with timestamp precision. CCTV from the premises where the access point is located can visually confirm that a person was present at the time the device was associated. Together, these sources construct a location narrative that is much harder to challenge than any single source. See Location History and Geolocation Artefacts for the full treatment of multi-source location reconstruction.

The investigator must also account for limitations that defence will raise. Wi-Fi range is not fixed: a high-gain directional antenna can receive probe requests from several hundred metres away, meaning the device could have been in a vehicle on a road outside a building rather than inside it. Access-point clocks may be unsynchronised, creating timestamp errors of minutes or more. MAC spoofing allows a deliberate actor to transmit a target device's MAC from a different device, potentially fabricating the association log entry. Each limitation must be addressed in the investigator's report, with a reasoned conclusion about whether the limitation materially affects the specific evidence being offered.

Worked example

Establishing device presence at a crime scene using Wi-Fi artefacts

Following a Wi-Fi evidence chain from access-point log through device acquisition to location conclusion in a commercial burglary investigation.

A commercial premises is burgled at 02:17. The building has an enterprise WLAN with a Cisco WLC that logs all association events to a SIEM. Investigators recover the SIEM logs and find that a device with MAC address DC:A6:32:XX:XX:XX associated with the building's guest SSID at 02:09 and disassociated at 02:34, with an average RSSI of -61 dBm, consistent with a device inside the building rather than in the car park. A suspect is arrested two days later. Follow the evidence chain below.

Preserve the AP logs. Request the SIEM export in its native format with cryptographic hash. Note that Cisco WLC timestamps are in UTC and confirm NTP synchronisation was active. Document the access point BSSID and its physical location within the building (floor, room reference) from the controller's site map.
Acquire the suspect's device. The suspect's phone is a Samsung Galaxy (Android 11). Request a physical acquisition to access /data/misc/apexdata/com.android.wifi/WifiConfigStore.xml. The device is in a locked state; JTAG acquisition is authorised. See JTAG and Chip-Off Acquisition for the procedure.
Parse the Wi-Fi configuration file. WifiConfigStore.xml contains an entry for the building's guest SSID with the BSSID of the access point recorded in the AP log. The lastConnectUid and timestamps confirm the device joined that specific network. The MAC recorded in the device file is the burned-in MAC, matching the AP log entry, confirming the device had not enabled per-network randomisation for this network (or was running Android 10 before it became the default).
Cross-reference with DHCP and network activity logs. The DHCP server assigned an IP address to the MAC at 02:09:43. Network flow logs show DNS queries and HTTP requests from that IP at 02:11 to 02:22. The queries resolve to a mobile device management endpoint consistent with the device type.
Assess radio evidence. The RSSI of -61 dBm is consistent with a device approximately 15 to 25 metres from the access point, which corresponds to the office floor where the burglary occurred based on an RF propagation survey of the building conducted with the same access point model. A device in the car park would show RSSI below -80 dBm through the exterior walls.
Document the limitation. The BSSID in the device's WifiConfigStore.xml could theoretically match a different access point operating the same SSID elsewhere, but the BSSID is unique to this specific radio and the entry's join timestamp falls within the burglary window. The conclusion is stated: the device was within the building's Wi-Fi coverage area, consistent with the office floor, during the period of the burglary.

Check your understanding

Question 1 of 4· 0 answered

A Wi-Fi adapter in monitor mode captures a probe request frame with the locally administered bit set in the source MAC address. What does this indicate?

Key Takeaways

Wi-Fi forensic evidence exists in three independent layers: access-point and network infrastructure logs, device-side artefacts such as preferred network lists and connection timestamps, and over-the-air packet captures of 802.11 management frames.
Probe request frames are broadcast unencrypted by client devices before any network connection is established, containing the source MAC address and previously joined SSIDs, and can be captured in plaintext by any monitor-mode adapter within radio range.
MAC address randomisation, now default on Android 8+, iOS 14+, and Windows 10 v1903+, complicates cross-network tracking but the burned-in MAC remains recoverable from device-side artefacts on physical acquisition, and probe request fingerprinting based on 802.11 capability element patterns can re-identify devices despite randomisation.
RSSI values in AP logs and packet captures indicate signal strength and are used to estimate device proximity to an access point, but radio propagation is environment-dependent and RSSI must be interpreted alongside a site RF survey rather than applied mechanically.
Wi-Fi evidence has different legal access requirements across jurisdictions: the UK Investigatory Powers Act 2016, the US Fourth Amendment and Carpenter v. United States (2018), India's Bharatiya Nagarik Suraksha Sanhita 2023, and the EU GDPR all govern collection, retention, and disclosure of Wi-Fi location data.

What is a probe request and why does it matter in Wi-Fi forensics?

A probe request is a broadcast frame transmitted by a Wi-Fi device when it actively scans for networks. The frame contains the device's MAC address and, in many implementations, the SSIDs of previously joined networks. Because probe requests are transmitted in plaintext over the air, they can be captured by any 802.11 monitor-mode receiver in range and used to prove that a specific device was present at a location at a given time.

Where are Wi-Fi association logs stored on an access point?

Enterprise access points and wireless LAN controllers typically store association event logs in their internal syslog buffer or stream them to a remote syslog server or SIEM. The log entry records the client MAC address, the SSID, the timestamp of association and disassociation, the signal strength (RSSI), and the channel. Consumer routers may store a shorter rolling log in NVRAM or may not log at all, in which case ISP RADIUS records or DHCP leases become the alternative source.

Can Wi-Fi evidence be used to prove a person was at a location?

Wi-Fi evidence proves that a device with a specific MAC address was within radio range of an access point or within capture range of a packet sniffer at a given time. Connecting that device to a specific person requires corroborating evidence: device registration, account credentials used on the network, or testimony. Courts in the US, UK, EU, and India have accepted Wi-Fi logs as corroborating location evidence when combined with other proof of device ownership.

What is MAC address randomisation and how does it affect Wi-Fi forensics?

MAC address randomisation is a privacy feature in modern operating systems, including Android 8 and later, iOS 14 and later, and Windows 10 version 1903 and later, that generates a random MAC address for each Wi-Fi network association rather than transmitting the device's globally unique burned-in MAC. Randomisation complicates tracking across multiple networks. However, the stable MAC is often still present in device-level artefacts such as OS logs, manufacturer databases, and older driver implementations, and some randomisation schemes produce predictable patterns.

What tools are used for 802.11 packet capture in forensic investigations?

The primary capture tool is Wireshark with an 802.11 monitor-mode adapter, which records all frames on a channel regardless of network membership. Aircrack-ng suite tools, particularly airodump-ng, record beacon frames, probe requests and responses, data frames, and management traffic. Commercial platforms such as AirMagnet and Ekahau are used in enterprise environments. All captures should be recorded with GPS timestamps where location correlation is required, and chain-of-custody documentation must accompany the capture file.

Test yourself on Mobile and Network Forensics with free, timed mocks.

Practice Mobile and Network Forensics questions

Found this useful? Pass it along.

Spotted an error in this page? Report a correction or read our editorial standards.

Key Takeaways

Your journey to becoming a forensic professional starts here.