What is device isolation?¶

Device isolation is the controlled reduction or removal of a device’s ability to communicate with other systems.

Evidential caution: that isolation simply means switching off Wi-Fi. A device may still communicate through mobile data, Ethernet, Bluetooth, USB, tethering, a docking station or another network path.

What this means¶

The purpose of isolation is usually to reduce remote access, remote deletion, synchronisation, malware communication or continued harmful activity.

Isolation is not the same as powering off. A device can remain powered on while some or all connections are removed.

It is also not the same as preservation. Isolation may help preserve evidence, but it can also change the system state, end sessions or interrupt data flows.

Before isolating, record the existing connection state. Capture network indicators, cables, connected devices, remote sessions, VPN status and any active alerts.

Choose the narrowest effective method. Removing one network cable may be enough in one situation, while another device may have several active connections.

Consider what the connection is supporting. It may carry cloud access, business services, live monitoring, authentication or evidence that exists only while the session remains active.

Where the device is part of a server, business network, industrial system or active cyber incident, specialist input may be required before isolation.

Document what was isolated, how, when, by whom and what changed afterwards.

Evidential limits¶

Do not assume that flight mode, SIM removal or a Faraday bag disables every route. Device behaviour varies, and some connections may remain active or resume later.