A company seizes a mobile device suspected of being used in committing fraud. What would be the BEST method used by a forensic examiner to isolate the powered-on device from the network and preserve t

The correct answer is A. Put the device in airplane mode. When dealing with a powered-on mobile device suspected of being involved in fraud, the best method for a forensic examiner to isolate the device from the network and preserve evidence is to put the device in airplane mode. Putting the device in airplane mode will: Disable all wir

Submitted by eva_at· Mar 5, 2026Security Assessment and Testing

Question

A company seizes a mobile device suspected of being used in committing fraud. What would be the BEST method used by a forensic examiner to isolate the powered-on device from the network and preserve the evidence?

Options

APut the device in airplane mode
BSuspend the account with the telecommunication provider
CRemove the SIM card
DTurn the device off

How the community answered

(25 responses)

A
68% (17)
B
8% (2)
C
4% (1)
D
20% (5)

Explanation

When dealing with a powered-on mobile device suspected of being involved in fraud, the best method for a forensic examiner to isolate the device from the network and preserve evidence is to put the device in airplane mode. Putting the device in airplane mode will: Disable all wireless communications, including Wi-Fi, cellular network, and Bluetooth, which prevents any further data from being sent to or received from the device. Allow the device to remain powered on, preserving volatile data (such as RAM contents) that could be crucial for forensic analysis. Prevent the device from connecting to external networks, which might overwrite or delete important evidence if the device syncs with cloud services, email accounts, or other systems.

Topics

#Mobile forensics#Evidence preservation#Network isolation#Incident response

Community Discussion

No community discussion yet for this question.

Full CISSP Practice