Could a powered-on device be remotely wiped?¶

A powered-on and connected device may be capable of receiving a remote wipe, lock or deletion command.

Evidential caution: that remote wiping is either impossible or certain. The actual risk depends on the device, account, management system, connectivity and whether a command has already been issued.

What this means¶

Remote wipe features may be available through consumer accounts, employer management tools, security software or administrative platforms.

A wipe may affect the whole device, a work profile, selected applications or account data. In some systems, a remote lock or password change may have a similar evidential effect by making content inaccessible.

Where the risk appears credible, record visible connectivity, account-management indicators, warnings and any evidence that remote administration is active.

What to check or do next¶

• Do not rush into isolation without recording the current state. Isolation may reduce remote risk, but it can also interrupt synchronisation, end sessions or affect volatile evidence.
• Seek specialist support quickly if the device is unlocked, encrypted, managed by an organisation or central to a serious investigation.
• If immediate isolation is necessary, use the least intrusive effective step and document what was changed, when and why.

Evidential limits¶

A command may arrive immediately, later or when the device next reconnects. Removing one connection route may not remove all others. Wi-Fi, mobile data, Ethernet, Bluetooth or tethered connections may remain.

Flight mode, SIM removal or cable disconnection may not disable every communication route. The correct method depends on the device and should not be assumed.