Should I put the device into airplane mode?¶

Airplane mode can reduce some network connections, but it is not a universal preservation method.

What this means¶

Turning it on changes the device.

That action may create logs, alter settings, affect running applications and change the evidence state. It may also fail to isolate every connection.

On many devices, airplane mode disables mobile-network service and may disable Wi-Fi or Bluetooth. But Wi-Fi and Bluetooth can sometimes be turned back on separately, may remain active in some configurations or reconnect later.

A device may also communicate through connected accessories, nearby devices or previously established services.

The benefit of isolation is that it may reduce incoming messages, synchronisation and remote access.

The risk is that changing the device may cause data loss, lock the screen, disrupt an active session, alter application behaviour or interfere with later interpretation.

First record the device as found: screen state, time, battery level, signal, Wi-Fi, Bluetooth, notifications and visible applications.

Then assess the immediate risks. Is remote wiping a realistic concern? Is the device unlocked? Is evidence actively arriving? Is specialist support available?

Where isolation is necessary, the method should be proportionate, authorised, recorded and based on specialist guidance where possible.

The operational takeaway is: airplane mode is one possible isolation step, not a default rule. Record the device first, understand which connections are actually active, and use a deliberate preservation method that balances remote-change risk against the danger of altering or losing evidence.

What to check or do next¶

• Do not apply airplane mode automatically.

Evidential limits¶

Physical isolation measures may also have limitations. Signal-blocking containers can affect battery consumption, heat and connectivity, and they do not remove the need to document what was done.