🚧 Under construction — VoTechWorks is being built. A free tech program — complimentary, as our commitment to get America working.
voTechWorksGrade 13 · a vocational technology learning center, by urbanicity
newSchoolWorks.com › VoTechWorks › Agriculture, Environment & Public Service › Crime Scene / Forensic Technician › Digital Evidence Intro › Lesson 4
AGR-CSI53-06 · Lesson 4 · 15 clock hours · demo

First-Responder Protocols: Mobile Devices

Objective. Students will isolate a powered-on mobile phone from network communications using a Faraday bag and airplane-mode procedure, and document the device without unlocking or browsing its contents.

⚠ Pending professional review

This lesson, its worked examples and its practice questions has not yet been verified by a licensed professional in the field or by a certification or approval body. It is a study draft and may contain errors. Do not use it as instructions for work on a job site or on live equipment. Always follow your instructor, your supervising professional, and current official references and regulations.

VoTechWorks program approval and accreditation are still in progress. Credentials are issued only by the certifying bodies named in each program, after their own exams.

Why Mobile Devices Demand Immediate Action

When you arrive at a scene and find a powered-on mobile phone, you are racing against an invisible threat: remote commands. A suspect, accomplice, or automated cloud service can issue a remote-wipe instruction that erases the device's storage within seconds — long before it ever reaches the forensic lab. Unlike a desktop computer, a smartphone maintains a constant connection to cellular towers and Wi-Fi networks unless you physically sever that link. Your first job as a first responder is to isolate the device from all wireless communication while leaving its contents exactly as found.

The Three Threats You Are Blocking

Mobile devices communicate over multiple radio frequencies simultaneously. You must account for all of them:

A Faraday enclosure — whether a purpose-built Faraday bag, an RF-shielded evidence box, or an improvised aluminum-foil wrap inside an anti-static bag — works by surrounding the device in a conductive shell that absorbs and redirects electromagnetic energy, preventing signals from entering or leaving. This is the same principle used in laboratory shielded rooms, scaled down to a field-portable form.

Airplane Mode Is a Secondary Control, Not a Substitute

Some agencies document the device's airplane-mode status before bagging it. Placing a phone in airplane mode cuts radios quickly and prolongs battery life, which keeps volatile data alive. However, airplane mode is not a substitute for Faraday isolation because:

1. Software or malware can re-enable radios without user interaction on some platforms.

2. You may not be authorized to touch the screen at all — any swipe could alter timestamps or trigger a passcode lockout.

If you can enable airplane mode without unlocking or browsing the device (for example, a shortcut visible on the lock screen), document that action in your notes with the exact time. If you cannot do so without interacting with protected content, go straight to the Faraday bag.

How to Place a Device in a Faraday Bag

1. Photograph first. Before touching the device, capture it in place with a DSLR and an ABFO No. 2 scale card. Your frame must show the screen state, any visible damage, and surrounding scene context. Do not move the device to get a better angle — move yourself and the camera.

2. Note battery level and screen state on your scene notes and on the photo log.

3. Open the bag fully so you never touch the device's screen against the bag lining during insertion.

4. Slide the device in screen-face up, seal the bag, and double-roll the closure if the bag uses a roll-top seal.

5. Verify isolation using a signal-indicator app on a second device: call the number or ping the Wi-Fi address. No response within 30 seconds, combined with the absence of signal bars or Wi-Fi icon on the bagged phone (visible through any transparent window), is your pass criterion.

6. Label the bag with case number, item number, date, time, and your initials. Do not write on the bag with enough pressure to damage the device inside.

RF-Shielded Boxes and Improvised Wrapping

For tablets or larger devices, RF-shielded evidence boxes provide the same Faraday effect with more physical protection. For feature phones in the field when dedicated equipment is unavailable, multiple layers of heavy aluminum foil formed tightly around the device — with no gaps at the seams — placed inside an anti-static bag can provide temporary shielding. Anti-static bags alone do not block RF; the foil layer does the work. This improvised method is a stopgap only; transfer to a certified Faraday container as soon as possible and document that you used the improvised method.

Documentation: What the Photos Must Show

Every photograph you take becomes potential courtroom evidence. Each image must contain:

Never swipe, tap, or press any button to brighten the screen. If the screen dims while you are photographing, wait — you may use a flashlight held at an oblique angle to illuminate a dark screen without touching the device.

Safety and Legal Boundaries

Handle all devices with nitrile gloves to protect latent print evidence on the surface. Do not use latex if latex allergies are a concern in your team. Place the device on a clean, non-conductive surface before photographing; avoid metal tables that could ground the device unexpectedly. Never connect the device to a charging cable or USB port without explicit authorization from the examiner assigned to the case — connection can trigger data transfers or trust dialogs that alter evidence. Your authority at the scene is to preserve and document, not to examine content. Unlocking or browsing the device without a valid legal authority (such as a signed search warrant or a recognized exception) exposes the evidence to suppression and exposes you to professional and legal liability.

Key terms9

Faraday bagA portable enclosure lined with conductive material that blocks all incoming and outgoing radio-frequency signals, preventing remote communication with a device inside.
Remote wipeA command sent over a network connection that instructs a mobile device to erase its stored data, a primary reason for immediate RF isolation at a scene.
RF shieldingAny conductive barrier — bag, box, or foil wrap — that absorbs and redirects electromagnetic energy so that radio signals cannot pass through.
Airplane modeA device setting that disables onboard radios; useful as a secondary control but not a substitute for Faraday isolation because software can re-enable radios without user action.
ABFO No. 2 scaleA standardized photographic reference scale with both metric and color-reference elements, used in forensic photography to establish accurate measurements in the image.
Anti-static bagA metalized or plastic bag designed to prevent electrostatic discharge damage to electronics; it does not block RF signals and must be combined with foil for improvised shielding.
Volatile dataInformation stored in a device's active memory or dependent on power, such as running processes, decryption keys, and unsaved messages, which is lost if the device loses power.
Chain of custodyThe documented, unbroken record of who collected, handled, transferred, and stored a piece of evidence from the scene to the courtroom.
Signal-blockage verificationThe field test used to confirm Faraday isolation by attempting to reach the isolated device via call, text, or network ping from a second device and confirming no response.
In class: Instructor demonstrates the risk of remote wipe and the purpose of Faraday shielding, then shows proper placement of a live phone into a Faraday bag, verifying isolation with a signal-indicator app on a second device. · Students rotate through three stations—smartphone in a Faraday bag, tablet in an RF-shielded box, and a feature phone wrapped in aluminum foil and placed in an anti-static bag—performing isolation at each and testing signal blockage. · Photographic documentation drill: before isolation, students photograph each device in place using a DSLR with a scale card, capturing the screen state, physical condition, and surrounding scene context; photos are reviewed by the instructor for completeness and correct scale placement.
Materials: Faraday bags (various sizes), RF-shielded evidence boxes, aluminum foil, anti-static bags, training smartphones and tablets (no SIM, Wi-Fi disabled by default), DSLR cameras, ABFO No. 2 scale cards, signal-indicator app on instructor device
Check: Signal-blockage verification (phone shows no bars or Wi-Fi symbol inside container = pass); photographic documentation checklist scored at 80% or higher; no instance of screen-browsing or unlocking without authorization.

Practice check8

Answer each question, then check it. Nothing is recorded; this is your own practice.

Crime Scene Documentation
1. A first responder finds a powered-on smartphone displaying a locked screen at a crime scene. What is the FIRST action she should take?
Digital Evidence Handling
2. Which of the following BEST explains why airplane mode alone is not considered sufficient isolation for a mobile device at a crime scene?
Digital Evidence Handling
3. A technician wraps a feature phone in several layers of aluminum foil at a scene where no Faraday bag is available. She then places it in an anti-static bag. Which statement about this procedure is CORRECT?
Crime Scene Photography
4. During a photographic documentation drill, a student's close-up image of a smartphone clearly shows the device but the scale card is placed vertically against the wall behind the phone rather than flat on the same surface plane. What is the problem with this photograph?
Digital Evidence Handling
5. After placing a tablet into an RF-shielded evidence box, a technician calls the tablet's registered number from his personal phone. The call rings twice before going to voicemail. What should he conclude?
Crime Scene Safety and Evidence Integrity
6. Which personal protective equipment is MOST appropriate when handling a mobile device to preserve latent print evidence on its surface?
Crime Scene Documentation
7. A locked smartphone at a crime scene has a dimming screen. A student wants to capture the screen content before it goes dark. Which action is CORRECT?
Chain of Custody and Evidence Documentation
8. Which of the following information is REQUIRED on the label affixed to a sealed Faraday bag containing a mobile phone?
Record this lesson on my transcript. Sign in with your key and enrollment email to record lessons (enroll free if you have no key). This page stays open to read and practise.
← Previous lessonProgram planNext lesson →