A Faraday bag preserves a seized phone or tablet as digital evidence by wrapping it in a conductive shell that blocks cellular, Wi-Fi, Bluetooth, and GPS signals, so nothing can wipe it remotely, overwrite stored data, or track it between seizure and forensic examination. Using Faraday bags for digital evidence correctly means more than dropping the device inside and closing the flap: the device has to be documented, kept powered, kept in the right encryption state, sealed with tight folded closures, tested, and logged into a chain of custody that will hold up in court.
Why Signal Isolation Is Non-Negotiable
The Supreme Court held in Riley v. California that police generally need a warrant before searching digital information on a cell phone seized during an arrest.1Justia Law. Riley v. California 573 U.S. 373 (2014) That creates a gap between seizure and lawful examination, and during that gap the phone is exposed. Someone with the account credentials can trigger a factory reset. Incoming messages, updates, and sync commands can overwrite the data an examiner needs.
Federal prosecutors have documented cases where suspects arranged remote wipes of seized phones from overseas before the FBI could image them. NIST warns that new traffic such as SMS can overwrite existing data, and that vulnerabilities in the operating system or apps could later be used to argue evidence was modified after seizure.2National Institute of Standards and Technology. NIST Special Publication 800-101 Revision 1 – Guidelines on Mobile Device Forensics Data received after seizure also raises questions about whether it falls within the scope of the original search authority. Signal isolation removes all of these problems at once.
What to Look for in a Forensic-Grade Bag
Shielding effectiveness is measured in decibels of attenuation. A bag rated at 80 dB cuts signal strength by a factor of 100 million. Forensic-grade bags typically aim for 60 to 80 dB across common mobile frequencies. That rating matters because a device that still senses a faint signal will keep hunting for a connection, burning battery and potentially reaching a nearby tower.
Forensic-grade bags use multi-layered metallic fabrics, usually silver, nickel, or copper woven into the lining. Layering matters because no single metal blocks every band equally well; the layers cover each other’s weaknesses across the spectrum. The closure is at least as important as the fabric. A bag with excellent shielding and a weak seal is functionally useless, because leakage at the opening defeats the whole enclosure. Look for dual-fold Velcro or magnetic closures designed to keep continuous conductive contact when fastened. The opening is the primary failure point in nearly every documented bag failure.
Some manufacturers reference IEEE 299, a standard for measuring shielding effectiveness of electromagnetic enclosures. MIL-STD-188-125-1 is sometimes cited as a benchmark for Faraday bags, but that standard governs high-altitude electromagnetic pulse protection for fixed ground-based military facilities and does not apply to portable shielding bags. Look instead for documentation showing at least 60 to 80 dB of attenuation across cellular, Wi-Fi, and Bluetooth frequencies. Professional bags generally run $30 to $150 depending on size and rating. Test any bag with a live device before you rely on it in the field.
Preparing the Device Before It Goes In
What happens before the phone enters the bag matters as much as the bag itself. Document the device type, make, model, battery level, and whether the screen is on or locked. Photograph any visible screen activity. Record the exact time. This information goes on the evidence tag and gives later analysts a baseline for the device’s condition at seizure.
Keep the Device in After First Unlock State
Modern smartphones use file-based encryption that keeps most user data inaccessible until the owner enters a passcode at least once after the device boots. A phone in Before First Unlock state, meaning it has restarted or lost power without the passcode being entered, gives forensic tools access to almost nothing beyond system logs and cached metadata. Once unlocked even once, the phone enters After First Unlock state, and the encryption keys stay in memory. An extraction in this state can recover roughly 95 percent of the accessible data, including messages, photos, browsing history, and app data.
Letting a device die inside a Faraday bag is one of the worst outcomes for an investigation. If the battery runs out and the phone reboots, it returns to Before First Unlock, and the investigator may have no way past the lock screen. Keeping the device powered is not optional.
Airplane Mode as a Second Layer
Engaging airplane mode before sealing adds software isolation on top of the bag’s physical shielding. NIST notes that enabling airplane mode requires interacting with the device, which carries some risk of altering data, and that airplane mode does not disable GPS in every case.2National Institute of Standards and Technology. NIST Special Publication 800-101 Revision 1 – Guidelines on Mobile Device Forensics The Scientific Working Group on Digital Evidence goes further, warning that newer operating systems may not fully disable Bluetooth, Bluetooth Low Energy, Wi-Fi, and other wireless protocols through airplane mode, or may only disconnect them temporarily.3Scientific Working Group on Digital Evidence. Best Practices for Mobile Device Evidence Collection, Preservation, Handling, and Acquisition Relying only on airplane mode means relying on the phone’s software to behave as expected, which is not something forensic work should depend on. The bag is the physical guarantee; airplane mode is the backup.
There is also a battery reason to use both. Inside a bag, a phone that isn’t in airplane mode ramps up antenna power hunting for signal, draining much faster than normal. Airplane mode stops that search and extends the time you have before the battery becomes a problem.
Sealing the Bag
Phones and Small Devices
Place the device flat at the bottom of the bag so it does not bunch up near the opening. Fold the top edge over at least twice, creating a layered path radio waves cannot easily navigate. Each fold adds another conductive barrier, and tight, even folds are essential; wrinkles or air gaps create channels for leakage. Press the Velcro or magnetic closure firmly across the full width of the fold. Run your fingers along the seal to feel for gaps, ripples, or spots where the layers aren’t in contact. If the device or internal padding is pushing against the closure, reposition and reseal.
Laptops and Larger Devices
Larger devices need oversized bags, often roll-top models that seal differently from pouch styles. Roll-tops typically need at least three full folds, with some manufacturers recommending up to five. Each fold should be tight and forward-facing, with both edges meeting evenly. Misfolded roll-tops are the most common source of signal leaks in waterproof Faraday bags. Before sealing, wipe the closure area to remove lint or debris that can prevent full contact between magnetic strips or conductive surfaces.
Verify the Seal
Whatever the device size, test the seal immediately after closing. The simplest check is to call the phone number of the sealed device or send it a Bluetooth ping. If the call connects or the ping succeeds, the bag has failed and needs to be resealed or replaced. SWGDE recommends regularly testing shielding containers even outside active cases, because materials degrade and closures weaken with repeated use.3Scientific Working Group on Digital Evidence. Best Practices for Mobile Device Evidence Collection, Preservation, Handling, and Acquisition Even a brief exposure to a network during a transfer between shielded spaces can be destructive to the data.
Keeping the Device Powered Without Breaking the Shield
Because staying in After First Unlock state depends on the battery, some forensic-grade bags include integrated USB filter ports. These filters let an external power source charge the device through the bag wall without opening the RF shield. The filter blocks data signals and passes only power, so the phone stays charged with no risk of network communication through the cable.
SWGDE specifically warns against running an unfiltered cable from a device inside a Faraday enclosure to an external power source, because the cable can act as an antenna and compromise the shielding.3Scientific Working Group on Digital Evidence. Best Practices for Mobile Device Evidence Collection, Preservation, Handling, and Acquisition Without a built-in filtered port, the only safe option is to keep the cable out entirely and get the device to a shielded forensic lab quickly. If you expect any delay in examination, buy bags with integrated USB filtering rather than improvising a cable pass-through.
How Faraday Bags Fail
Investigators who treat these bags as guaranteed isolation are making a mistake. NIST documents testing at Purdue University that evaluated multiple commercial shielding devices across three major U.S. carriers at varying distances from cell towers. The majority of devices tested failed to prevent network communication in all cases. SMS messages penetrated the shielding most often, followed by voice calls and MMS.2National Institute of Standards and Technology. NIST Special Publication 800-101 Revision 1 – Guidelines on Mobile Device Forensics Three failure modes explained the results: materials that didn’t provide enough attenuation, leaks at seams or openings, and shields that themselves acted as antennas.
SWGDE echoes the concern in its 2025 best practices, cautioning that RF shielding containers are not always fully effective and that agencies should test their bags routinely.3Scientific Working Group on Digital Evidence. Best Practices for Mobile Device Evidence Collection, Preservation, Handling, and Acquisition Any cable connected to a shielded container must be fully isolated, because an exposed cable running from an internal device to external power defeats the shield. That is the single most common way investigators accidentally compromise their own isolation setup.
Chain of Custody and Storage
Once sealed, apply tamper-evident tape across the closure. The person performing the seizure signs and dates the tape to establish a verifiable point of origin. Attach a unique evidence label to the outside of the bag with the case number and a brief description of the contents. These identifiers must match entries in the official chain of custody log exactly.
The chain of custody form records every person who handles the evidence, along with the time and location of each transfer. Every handoff gets an entry. Gaps give defense attorneys a straightforward argument that the evidence could have been altered between seizure and trial, and courts have excluded digital evidence on exactly that basis. Store the sealed bag in a climate-controlled environment away from excessive heat and strong magnetic fields, both of which can damage the device or degrade the shielding fabric over time.
Legal Exposure for Mishandling Digital Evidence
Deliberately tampering with or destroying digital evidence carries serious federal penalties. Under 18 U.S.C. ยง 1519, anyone who knowingly alters, destroys, or conceals any record or tangible object to obstruct a federal investigation faces up to 20 years in prison.4Office of the Law Revision Counsel. United States Code Title 18 – Section 1519 Section 1512(c) carries the same 20-year maximum for anyone who corruptly destroys or conceals evidence intended for use in an official proceeding.5Office of the Law Revision Counsel. United States Code Title 18 – Section 1512 The maximum fine for either offense is $250,000 under the general federal felony fine statute.6Office of the Law Revision Counsel. United States Code Title 18 – Section 3571
These penalties apply to anyone, not only law enforcement. A suspect who remotely wipes a seized phone, a third party who helps arrange it, or an officer whose negligence allows destruction can all face prosecution. Proper isolation is not just how you build a strong case. It is a legal obligation, and failing to prevent evidence alteration can unravel a prosecution or create liability for the agency holding the device.