What can Wi-Fi records show?¶
title: What can Wi-Fi records show? subtitle: They may show configured, remembered, observed or connected networks—not automatically who used the device or exactly where it was. slug: what-can-wi-fi-records-show series: mobile-extraction-and-reader-reports section: interpreting-common-artefacts card_type: question_card content_type: core-operational risk_level: normal pathway_order: 36 section_order: 11 status: draft owner: IF Digital last_updated: '2026-07-25' version: '0.1' review_gate: pending review_mode: ai-assisted review_timebox_mins: 30 qa_gate: pending qa_count: 0 pipeline_ref: PIPELINE_PRG_001 pipeline_version: '1.1' public_safe: true video_ready: true word_count: 478 estimated_read_time_seconds: 198 audiences: - investigator - supervisor - fraud and compliance practitioner tags: - mobile evidence - Wi-Fi - network records - location - association sources: - title: SWGDE Best Practices for Mobile Device Forensic Analysis url: https://www.swgde.org/documents/published-complete-listing/20-f-005-swgde-best-practices-for-mobile-device-forensic-analysis/ - title: 'NIST SP 800-101 Rev. 1: Guidelines on Mobile Device Forensics' url: https://csrc.nist.gov/pubs/sp/800/101/r1/final - title: 'Apple Support: About privacy and Location Services' url: https://support.apple.com/en-gb/102515 - title: 'Google Android Help: Manage your Android device’s location settings' url: https://support.google.com/android/answer/3467281?hl=en-GB
What can Wi-Fi records show?¶
They may show configured, remembered, observed or connected networks—not automatically who used the device or exactly where it was.
Script¶
Wi-Fi records can help show which networks a device knew about, observed or used.
The meaning depends on the record type.
A saved or remembered network shows that the device stored a network name or configuration.
That may result from a previous connection, a backup restore, device migration, enterprise configuration or synchronisation.
It does not automatically show that the handset connected during the period under investigation.
An observed network record may show that the device detected a nearby access point.
The device may not have authenticated or joined it.
An association or connection record is stronger evidence that the device connected to the network according to the system that logged it.
Even then, establish the time, access point and device identity.
Useful fields may include:
the network name or SSID;
access-point identifier or BSSID;
security type;
last-connected or last-seen time;
connection state;
configured credentials;
IP address;
and source file.
The SSID alone is not unique.
Many homes and businesses use default names such as BT, Sky, Guest or Public Wi-Fi.
A BSSID is normally more specific to an access point, but access points can be replaced, cloned or configured with several radios.
Location databases may associate a BSSID with a place, but that information can change and should be corroborated.
Wi-Fi also contributes to location services.
Apple and Google both explain that nearby Wi-Fi can help determine device location.
A Wi-Fi observation may therefore appear within a location or system-service artefact even where the device did not join the network.
Don't convert every observed access point into proof of connection.
Consider account and backup effects.
A new phone may inherit remembered networks from an earlier device.
A business profile may configure networks automatically.
Several devices may use the same cloud account or enterprise policy.
The presence of a saved network can therefore show account or configuration history rather than physical presence of this handset at the network.
Look for stronger local evidence.
Was an IP address assigned?
Did the device record connection start and end?
Are there browser, application or network records during that period?
Does the router or organisational Wi-Fi controller record the device?
Can the device identifier or MAC address be linked reliably, bearing in mind that modern phones may use private or randomised Wi-Fi addresses?
The common mistake is:
“The phone remembers this Wi-Fi network, so the suspect visited the address.”
The record may have been restored or configured elsewhere.
Another mistake is:
“The network name is unique to this house.”
The same SSID may exist in many places.
A careful conclusion might say:
“The handset’s Wi-Fi configuration contains this BSSID and records a last association at this time. The access-point controller independently records the device during the same period.”
That is much stronger.
Wi-Fi evidence can support location, device use and network access.
Keep saved configuration, observation and confirmed association as separate propositions.
Key takeaway
Identify whether the record shows a saved network, observation or actual association, and corroborate the access point and time.
Related questions¶
- What can location records show?
- What can Bluetooth records show?
- How do I record where an artefact came from?
Source notes¶
- SWGDE Best Practices for Mobile Device Forensic Analysis
- NIST SP 800-101 Rev. 1: Guidelines on Mobile Device Forensics
- Apple Support: About privacy and Location Services
- Google Android Help: Manage your Android device’s location settings