Wireless Forensics · Digital Forensics · RF Forensics · Budding Forensic Expert

Can the Wi-Fi Around a Crime Scene Become Evidence?

Can radio waves tell investigators what devices were doing — and possibly where they were?

The investigators walk into an apartment where something has clearly gone wrong. There is no usable latent print on the door handle. The hallway camera outside was pointed the wrong way. The suspect's phone — the object every modern investigation seems to hinge on — was never recovered; it may be at the bottom of a river, or simply switched off in a drawer somewhere.

But the apartment, like almost every apartment in urban India today, was full of invisible radio traffic. A router in the hallway. A smart TV. A neighbour's access point bleeding signal through the shared wall. A phone that, at some point, must have brushed past all of it.

The question that follows is not a comfortable one for a field that has spent two decades building its reputation on fingerprints, DNA and CCTV: could that invisible radio environment — the Wi-Fi that was quietly humming through the walls before, during and after the event — contain evidence that something, or someone, was there?

Introduction

Every Wi-Fi-enabled device in a room is constantly doing two things at once. It is carrying data — the ordinary job of a wireless network. And, almost as a side effect, it is disturbing the radio-frequency (RF) environment around it: reflecting off walls, scattering around furniture, and being subtly reshaped by every body that moves through its path. The first job is what network forensics has studied for years, through logs, packets, and identifiers. The second job — the physical disturbance of radio waves themselves — is a newer, stranger question, and it sits at the intersection of RF engineering, wireless-sensing research, and forensic science.

This article is about that second question. It is not about hacking, unauthorised interception, or covert surveillance techniques. It is an evidence-first investigation into a scientific and forensic question: under what conditions, if any, can the radio-frequency environment around a crime scene become something a court could treat as evidence?

Quick answer: Wireless activity, network logs, and RF measurements such as signal strength or Channel State Information can, in principle, provide investigative information about device presence, movement, or timing. Peer-reviewed research shows real capability in controlled settings. But turning any of this into forensic evidence a court would accept requires attribution to a specific device or person, demonstrated reliability, quantified uncertainty, and independent corroboration — conditions that, for most of these techniques, have not yet been met in routine practice.

1. What Does "Wi-Fi Evidence" Actually Mean?

"Wi-Fi evidence" is not one thing. It is a loose label covering at least three very different layers of information, and conflating them is the single most common mistake in casual discussions of wireless forensics.

The first layer is network-layer evidence: the logs, records, and metadata that routers, access points, and authentication servers generate as a normal part of running a network — DHCP leases, authentication logs, DNS queries, connection timestamps, device identifiers such as MAC addresses and hostnames. This is closest to conventional digital forensics; it is discrete, stored, and (when preserved) directly readable.

The second layer is signal-measurement evidence: quantities like Received Signal Strength Indicator (RSSI) and Channel State Information (CSI) that describe how a radio signal behaved as it travelled from transmitter to receiver. These are not "logs" in the traditional sense — they are physical measurements of the RF environment, and they exist whether or not anyone is capturing them.

The third layer is behavioural and physical-layer evidence: probe-request activity, timing patterns, and RF fingerprints — the idiosyncratic ways a specific device's hardware and software emit signals, independent of whatever identifiers it claims to have.

Network-layer evidence answers "what did this network record?" Signal-measurement and physical-layer evidence attempt to answer a much harder question: "what did the physical world itself record?" The rest of this article is mostly concerned with the second and third layers, because they are where the genuinely new forensic science is happening — and where the genuine limitations live too.

2. Could Radio Waves Really Become Forensic Evidence?

Follow a signal's life cycle and the answer starts to take shape. A device transmits. The signal propagates through the room, reflecting off walls, refracting around door frames, attenuating through bodies and furniture. A receiver — another device, an access point, a dedicated sensor — captures what is left of that signal and can extract measurable features from it: amplitude, phase, timing, frequency response. Those features can, with the right processing, be turned into inferences: that something moved, that a device was nearby, that a particular piece of hardware was involved.

That is the chain: transmission → propagation → environmental interaction → measurement → feature extraction → interpretation → forensic inference. Every link in that chain is real and demonstrated in research literature [8][22]. The problem is not whether radio waves carry information about their environment — they demonstrably do. The problem is how much of that information survives the trip from "a laboratory demonstrated X" to "this specific device was physically present at this specific location at this specific time, to a standard a court can rely on."

That distinction — "there was wireless activity in this area" versus "this specific device was physically present at this specific location" — is the fault line that runs through almost every claim in wireless forensics. Nearly all controversy in this field, and most of the overclaiming that circulates in popular coverage, comes from collapsing that distinction.

3. What Does Wi-Fi Actually Leave Behind?

The table below separates what a wireless environment can plausibly leave behind, by category, along with realistic survival windows and the main limitation on each.

Table 1 — Types of wireless evidence and what each can reveal

Evidence source	What it may show	How long it may survive	Main limitation
Access-point / router logs	Connected devices, session times, hostnames	Minutes to weeks (consumer routers often overwrite quickly)	Retention varies wildly; many consumer routers keep little or nothing
Authentication logs (RADIUS/enterprise)	Which credential/device authenticated, when	Weeks to months on managed systems	Rare outside enterprise/institutional Wi-Fi
DHCP records	IP-to-MAC assignment, lease duration	Hours to days typically	Short retention; NAT and randomization complicate attribution
DNS logs	Domains queried by a device on the network	Variable; often not logged on home routers	Encrypted DNS (DoH/DoT) increasingly hides queries from the router
Device identifiers (MAC, hostname)	A device "seen" on the network	As long as logs persist	MAC randomization breaks simple identifier-based tracking [17]
RSSI	Coarse signal-strength trend, rough proximity	Only if captured live; not stored by default	Highly noisy; not a reliable distance proxy [22]
Channel State Information (CSI)	Fine-grained multipath / movement signature	Only if actively captured; not stored by default	Requires specialised hardware and controlled setup [8]
Probe-request activity	A device was searching for networks nearby	Only if captured live by a sensor	Frequency, randomization, and spoofing complicate attribution [18]
Traffic timing patterns	Activity bursts that may correlate with events	Only if actively logged	Correlation is not attribution
RF hardware fingerprint	A specific physical transmitter's signature	Persistent (it is a hardware property) if captured	Requires specialised capture equipment; largely lab-stage [1]

4. What Is RSSI, and Why Doesn't "Stronger Signal" Mean "Closer Device"?

RSSI is simply a measure of how much power a receiver detects from an incoming signal. The intuitive leap — stronger signal, closer device — is the assumption almost everyone makes and almost everyone is wrong to make, at least at the precision a courtroom would need.

The reason is that RSSI collapses an enormously complex physical process into a single number. A wall between transmitter and receiver, a body standing in the path, the antenna's orientation, a nearby metal cabinet, another network operating on an overlapping channel, even the specific chipset's transmit-power calibration — all of these change RSSI by amounts that are often larger than the signal-strength difference between "two metres away" and "six metres away." Reviews of RSSI-based indoor positioning consistently report localization errors in the range of roughly one to several metres even under favourable, purpose-built conditions [22][26], and error grows sharply in cluttered, uncontrolled indoor spaces of the kind an actual crime scene usually is.

RSSI is genuinely useful for coarse questions: was this device closer to Access Point A or Access Point B? Was there a change in the environment around a particular time? It is not, on its own, a reliable tool for placing a device at a specific spot in a room.

5. What Is CSI, and Why Is It So Interesting to Forensic Scientists?

Channel State Information goes several layers deeper than RSSI. Modern Wi-Fi (OFDM-based) splits a channel into dozens of subcarriers, and CSI captures how each of those subcarriers' amplitude and phase were altered on the trip from transmitter to receiver. Where RSSI gives you one blurry number, CSI gives you a rich, high-dimensional fingerprint of exactly how the radio channel was shaped by everything in its path.

That richness is precisely what has made CSI the workhorse of the Wi-Fi-sensing research community over the last decade. A large and now well-established body of research uses CSI to infer human presence, breathing rate, gross body movement, gestures, and occupancy changes — all without the sensed person carrying or connecting any device [8][9][10][11]. The 2019 ACM Computing Surveys review by Ma, Zhou and Wang remains a widely cited synthesis of this literature, cataloguing CSI-based systems for activity recognition, localization, and vital-sign sensing [8].

Here is where the science gets interesting for a forensic reader. If CSI can register the fact that a body moved through a room, entered it, or left it, then in principle a wireless-sensing system deployed near a crime scene could register comparable disturbances. The forensic question is not whether CSI reacts to human presence — it demonstrably does, repeatedly, across dozens of published studies. The forensic question is whether that reaction can be captured, stored, attributed, and interpreted with enough rigour to mean something in an investigation, months after the fact, without a purpose-built sensor having been running at the time. For the overwhelming majority of real-world Wi-Fi deployments — a consumer router that was never configured to log CSI — the answer today is no: CSI is not retained by default, and reconstructing it after the fact is not possible.

6. Can Wi-Fi Detect a Person Who Never Connected to the Network?

This is one of the more counter-intuitive findings in wireless-sensing research, and it deserves to be stated plainly: yes, in laboratory and field-tested settings, device-free Wi-Fi sensing can register a human presence even when that person is carrying no wireless device at all and has never associated with the network.

This works because the human body itself is part of the propagation environment — it reflects, absorbs, and scatters radio waves regardless of whether it is carrying a transmitter. Systems built around commodity Wi-Fi hardware, including low-cost boards like the ESP32, have demonstrated presence and fall detection using exactly this principle [12], and more recent work has pushed this into genuinely adversarial, through-wall, non-line-of-sight conditions using sensors placed entirely outside the space being monitored [13][14].

It is important to be precise about what "detect a person" means in this research. Most published systems detect that a disturbance consistent with human presence or movement occurred — not who that person is, and rarely how many people, with high confidence, in cluttered multi-person environments. Distinguishing one specific person from another using CSI alone remains an active and only partially solved research problem, heavily dependent on controlled training data collected in advance for each individual. None of this is currently deployed as a routine investigative tool by law-enforcement agencies; it remains squarely in category (A)/(B) — laboratory and field-tested research.

7. Can Wi-Fi Tell Investigators Where a Device Was?

Location estimation from Wi-Fi generally falls into two families. Model-based methods — trilateration and multilateration — use RSSI (or time-of-flight) measurements from multiple access points and geometric models of signal decay to estimate a position. Fingerprinting methods instead compare a live measurement against a pre-recorded map ("survey") of what the RF environment looks like at many known reference points, then find the best match.

Published accuracy figures vary enormously depending on method, environment, and how much site-specific calibration was done beforehand. RSSI-only trilateration studies commonly report errors in the range of roughly one to six metres in controlled corridors and labs [24][26]; fusing RSSI with other sensors (inertial measurement units, ranging protocols like Wi-Fi Round-Trip-Time, or LiDAR) has pushed reported errors down toward the sub-metre range in some recent studies, but only in the specific, calibrated test environment where the system was built and tuned [23][25]. A 2025 fusion study, for instance, reported mean two-dimensional errors of roughly 0.24–0.38 metres for a multi-sensor system, compared with up to 1.34 metres for RSSI fingerprinting alone in the same building [25] — a useful illustration of just how much accuracy depends on what other sensors and prior calibration are available, none of which exist at a typical crime scene after the fact.

That last point is the crucial one for forensic purposes. Every high-accuracy result in this literature comes from a system that was deployed, calibrated, and surveyed before the measurement was taken. A crime scene, by definition, was not instrumented in advance. Reconstructing location after the fact, from whatever logs happen to exist, is a fundamentally weaker and less accurate problem than the one these papers solve.

8. Can Wi-Fi Track Someone Moving Through a Building?

Room-level occupancy and movement inference is one of the more mature strands of device-free Wi-Fi sensing. Multiple access points positioned around a building, each contributing CSI or RSSI measurements, can register transitions — a disturbance pattern consistent with movement from one room into another [15][16]. This has genuine potential forensic value: reconstructing rough movement, inferring entry or exit timing, or corroborating a claimed sequence of events.

But "movement reconstruction" in these papers almost always means movement within an instrumented environment that was set up specifically for this purpose, often with multiple access points placed deliberately to maximise sensing coverage. An ordinary home or office, with one or two consumer routers placed for connectivity rather than sensing, offers far weaker and far less complete coverage. What survives, in most real buildings, is coarse and gappy — closer to "something changed near this access point around this time" than a continuous trajectory.

The signal may tell investigators that something changed — but not necessarily why. A CSI disturbance consistent with movement could be a person, a pet, a moving curtain in an air current, or a robot vacuum. Interpreting a disturbance as "a person moved through the room" requires ruling out these alternatives, which laboratory studies control for and real crime scenes usually cannot.

9. Can Wi-Fi Identify the Device That Sent the Signal?

This is the domain of RF fingerprinting (RFF), and it rests on a genuinely elegant physical principle. No two radio transmitters, even identical models off the same production line, are perfectly identical. Manufacturing tolerances in oscillators, power amplifiers, mixers, and digital-to-analog converters introduce tiny, systematic imperfections — carrier frequency offset, I/Q imbalance, nonlinear amplifier behaviour — that imprint themselves on every signal that device transmits [1][3]. Foundational work by Cobb, Laspe, Baldwin, Temple and Kim on intrinsic physical-layer authentication demonstrated that these imperfections could be used to distinguish nominally identical integrated circuits [1], and early Wi-Fi-specific work by Yuan and Hu showed preamble-based detection of transmitter-specific RF fingerprints [2].

The appeal for forensics is obvious: unlike a MAC address, a hardware fingerprint cannot be changed with a software setting. But that sounds like a perfect forensic tool. It isn't — not yet, anyway. Stability is the open problem. RFF classifiers trained on signals from one receiver frequently degrade when the same transmitter is captured by a different receiver, because receiver-induced distortion tangles with the transmitter's genuine fingerprint [5]. Temperature, aging, firmware updates, and channel conditions all introduce drift that active research is still working to correct for [3]. And RF fingerprints are not immune to countermeasures: recent work has demonstrated that adversarial perturbations can deliberately mask a device's hardware signature from a classifier [4], which cuts directly against any assumption that RF fingerprinting is tamper-proof. Large, reproducible datasets needed to validate these methods across many same-model devices are still a recent and incomplete addition to the field [6]. This places most current RF-fingerprinting capability at (A) laboratory research and, for a narrower set of well-funded applications, (B) field-tested research — not (D) or (E).

10. Can Wi-Fi Detect a Device Without Knowing Its MAC Address?

Modern phones randomize their MAC address during Wi-Fi scanning specifically to defeat the kind of tracking this article is discussing, and for most casual observers this works. But a substantial and growing body of security research shows that randomization, by itself, is not the privacy guarantee it appears to be.

The foundational demonstration came from Vanhoef and colleagues, who showed that the Information Elements carried inside probe-request frames — vendor-specific extensions, supported-rate lists, and other optional fields — form a fingerprint that survives MAC randomization entirely, because randomization only changes the address field, not the rest of the frame [17]. Martin and colleagues extended this, showing that frame sequence numbers and randomization-implementation quirks across Android, iOS, Windows and Linux created further exploitable weaknesses [18]. Timing-based approaches add a third angle, using the characteristic inter-frame arrival intervals of a device's probe requests as a behavioural signature independent of any identifier [20][21]. Recent work describes systems combining these signals achieving very high re-identification accuracy against randomized addresses in test conditions [19].

What this body of research actually establishes for forensic purposes is narrower than "MAC randomization is broken." It shows that a sufficiently motivated observer, capturing raw 802.11 management frames with the right equipment at the right time, can sometimes re-associate randomized addresses with a persistent (if anonymous) device identity — not that this is routinely done, retroactively, from whatever a consumer router happened to log. A typical home router does not capture or retain raw probe-request Information Elements; it only sees devices that actually connect. This is a real capability with a real evidence base, but it depends entirely on purpose-built capture at the time, which is rarely present at an ordinary crime scene.

11. What Happens When Wi-Fi Evidence Is Missing?

Absence of logs is the default state, not the exception. Consumer routers typically retain connection and DHCP logs for hours to days before overwriting them; many keep nothing meaningful at all unless a user has specifically enabled logging. CSI and raw RSSI are almost never stored — they exist only for the instant a receiver processes them, unless a system was deliberately built to capture and retain them. Encrypted traffic hides payload content even where connection metadata survives. Devices with Wi-Fi disabled, or that never came within range of a monitored access point, leave nothing behind in this domain at all.

This creates an asymmetry that investigators need to hold onto carefully: the absence of wireless logs does not mean the absence of wireless activity. It usually just means nobody was capturing it. Treating a missing log as proof that "no device was ever there" is a common and serious inferential error.

12. Can Wi-Fi Evidence Be Faked?

Every layer of wireless evidence discussed so far has a corresponding way it can be manipulated, and any credible forensic use of this material has to start from that assumption. MAC addresses can be spoofed trivially with commodity software tools. Rogue access points can impersonate legitimate networks. Router logs, being ordinary files on a general-purpose device, can be edited or deleted by anyone with administrative access. Even RF fingerprints — the "hardware can't lie" layer — have been shown to be maskable through deliberate adversarial signal perturbation in research settings [4].

This article will not walk through operational techniques for spoofing or signal manipulation; that is a security-attack topic, not a forensic-science one. What matters here is the countermeasure side: authenticating RF evidence requires independent corroboration from a source that would be difficult for a single actor to manipulate simultaneously — cross-referencing router logs against access-point-independent CSI captures, cross-referencing wireless timing against CCTV or mobile-tower data, and documenting a clear chain of custody for however the RF data was captured and preserved. A single log file or a single RSSI trace, uncorroborated, should be treated with the same scepticism as a single uncorroborated witness statement.

13. Can a Wi-Fi Signal Reveal What Happened Inside a Room?

Wireless-sensing research can, under the right conditions, register presence, coarse movement, occupancy changes, and — in controlled lab settings — even breathing rate and gross gestures [8][10]. That is a genuinely long way from "reconstructing a crime." Detecting that a disturbance occurred is categorically different from determining what caused it, who was involved, or what specifically happened. No published research demonstrates CSI-based reconstruction of a specific criminal act; the field's demonstrated capability sits at "did something move here, roughly when" — a useful corroborating signal at best, not a narrative.

14. Can Wi-Fi See Through Walls?

Yes — with real physics behind it, and real limits. Wi-Fi signals in the 2.4 and 5 GHz bands do penetrate common building materials like drywall and wood, though they attenuate more sharply through concrete, brick, and especially reinforced structures. What "sees through walls" actually means in this research is not imaging in any visual sense; it is detecting that the CSI on the far side of a wall changed in a way consistent with a body moving or being present, using the same multipath-disturbance principle discussed in Sections 5 and 6.

Recent research has pushed this into genuinely adversarial conditions: sensors placed entirely outside a residence, with no interior access, still registering room-level presence patterns across two residential apartments and multiple wall materials [13]. Other work has demonstrated non-line-of-sight presence detection using commodity Wi-Fi chipsets without any bespoke sensing hardware [14]. This is where a laboratory demonstration becomes very different from courtroom evidence: these systems are built, tuned, and validated for the specific wall types and layouts in the study. Generalising a "yes, it can detect a person through this wall" result to an arbitrary, un-instrumented crime scene wall is not something the published literature currently supports.

15. Could Wi-Fi Help Reconstruct a Timeline?

The most defensible forensic use of wireless data today is probably not localization or through-wall sensing — it is timeline correlation. Authentication timestamps, DHCP lease events, connection and disconnection times, and any available signal-change data can be laid alongside CCTV timestamps, mobile-device evidence, and smart-home logs to build or check a sequence of events. If a router log shows a device authenticating at 11:47 pm and a smart lock logs an unlock event at 11:48 pm, that correlation — treated as corroboration rather than proof — is a legitimate and comparatively low-risk use of wireless data, because it leans on discrete, timestamped, network-layer evidence rather than the much less certain physical-layer inferences discussed earlier in this article.

16. Wi-Fi + Smart Homes: A New Forensic Evidence Source?

The modern home is dense with wireless-connected devices — smart speakers, cameras, thermostats, locks, TVs — each maintaining its own logs, often synced to a cloud service that retains data far longer than the router itself does. IoT-forensics researchers have proposed layered frameworks specifically to correlate evidence across the device, network, and application layers of this ecosystem, reconstructing timelines from smart-camera footage, app activity logs, and network-layer traffic simultaneously [29]. Case studies on individual devices — a study forensically examining a Xiaomi smart router's logs and companion-app database using NIST SP 800-86 and ISO/IEC 27037 methodology is a representative example [28] — show that meaningful artefacts do survive on real consumer hardware, though acquisition methods are often device- and vendor-specific and do not generalise easily.

Multiple systematic reviews of IoT-forensic models — covering frameworks such as Oriwoh's 1-2-3 Zone model, Perumal's Top-Down approach, and Kebande and Ray's DFIF-IoT — conclude that most remain conceptual or lab-validated rather than operationally proven at scale, with persistent gaps in event reconstruction, chain of custody, and evidentiary admissibility [27]. The practical takeaway: the wireless ecosystem around a house is a genuinely richer and more persistent evidence source than the router alone, but exploiting it well requires device-specific expertise, not a single generic "Wi-Fi forensics" toolkit.

17. Can Wi-Fi Evidence Help Establish Presence Without Identifying the Person?

This distinction deserves to be stated as plainly as possible, because it is the single most important legal and scientific boundary in this entire subject: a wireless signal can, at best, suggest that a device was likely in a location. It does not, by itself, establish who was holding that device. Presence evidence and identity evidence are different categories, and wireless data is fundamentally presence evidence — a device-level signal, not a person-level one. Bridging that gap requires independent evidence: ownership records, biometric unlock logs, corroborating witness testimony, or CCTV. Wireless data alone should never be treated as identity evidence.

18. How Reliable Is Wireless Forensic Evidence?

Reliability in this field has to be assessed layer by layer, not as a single blanket judgment. Network-layer evidence (logs, timestamps) is generally as reliable as any other digital record — subject to the same integrity and chain-of-custody requirements as a server log, and reasonably reproducible if the underlying system wasn't tampered with. RSSI-based localization shows meaningful but bounded accuracy, typically metre-scale under favourable, calibrated conditions, worse otherwise [22][26]. CSI-based sensing shows strong repeatability within the controlled environment it was trained and validated on, but published work consistently flags weak generalisation to new environments, new hardware, and new receivers as an open problem [5][13]. RF fingerprinting shows a genuine physical basis but immature stability across time, temperature, and receiver hardware [3][5]. None of this literature currently reports courtroom-relevant false-positive/false-negative rates measured on independent, blind test sets representative of real crime-scene conditions — which is precisely the gap Section 26 returns to.

19. What Could Make Wi-Fi Evidence Misleading?

A long list of ordinary, non-adversarial conditions can distort wireless measurements enough to produce a misleading inference, and it is worth having them in one place.

Table 5 — Factors that distort Wi-Fi measurements

Factor	Effect on measurement
Multipath propagation	Signal arrives via multiple reflected paths, confusing distance/direction estimates
Building materials (concrete, metal, brick)	Uneven attenuation; a "through-wall" result from one wall type may not generalise
Furniture and layout changes	Invalidates a previously-surveyed fingerprint map
Antenna orientation	Can swing RSSI by many dB without any change in distance
Co-channel interference / crowded spectrum	Adds noise indistinguishable from genuine environmental change
Device/chipset heterogeneity	Different hardware reports RSSI/CSI differently for the same physical conditions
Firmware/driver updates	Can silently change signal-processing behaviour mid-deployment
MAC randomization	Breaks simple identifier-based device tracking [17]
Deliberate spoofing/perturbation	Can mask or fake identifiers and, in research settings, even hardware fingerprints [4]
Uncalibrated deployment	Nearly all high-accuracy results assume prior site-specific calibration a real crime scene never has

20. Wi-Fi Forensics vs Traditional Digital Forensics

Table 3 — Traditional digital forensics vs wireless/RF forensics

Dimension	Traditional digital forensics	Wireless / RF forensics
Primary data source	Files, logs, storage media	Physical radio signals + network logs
Layer of evidence	Application/file-system layer	Network layer and physical (RF) layer
Device identification	Hashes, serials, registry artefacts	MAC address (spoofable) or RF fingerprint (immature) [17]
Localization capability	Rarely central	Central but uncertain; metre-scale at best under calibration [22]
Timeline reconstruction	Well-established (file timestamps, journals)	Possible via logs; physical-layer timing far less mature
Uncertainty	Generally low if data preserved intact	Often substantial; probabilistic, environment-dependent
Evidence acquisition	Bit-level imaging, established tools	Requires live capture; rarely retained by default
Validation maturity	Decades of Daubert-tested practice	Largely unvalidated for forensic use [31]

21. Wi-Fi vs GPS

GPS is satellite-based: under open sky, it provides direct, largely infrastructure-independent location with well-characterised accuracy. It degrades badly or fails entirely indoors and in dense urban canyons — precisely the environments where most crime-scene investigations happen. Wi-Fi positioning is the reverse: it depends entirely on existing infrastructure (access points, prior surveys), which makes it useless where no Wi-Fi exists, but potentially valuable exactly where GPS is weakest — indoors. Neither universally outperforms the other; they are complementary technologies suited to different environments, and current research increasingly fuses them with additional sensors (IMU, LiDAR) rather than treating either as sufficient alone [25].

22. Wi-Fi vs Cellular Forensics

Cell-tower forensics (Call Detail Record, or CDR, analysis) is a comparatively mature and court-tested field, with established methodology for estimating device location from tower connections and signal timing, though it too has well-documented accuracy limits, particularly in dense urban areas. Wi-Fi forensics differs on several axes that matter to an investigator: range (metres to tens of metres for Wi-Fi versus kilometres for a cell tower), the availability of logs (carrier-retained CDRs versus often-absent consumer router logs), and precision (potentially finer-grained indoors, but far less standardised and far less validated). Wi-Fi evidence is best understood today as a supplementary, corroborating source alongside cellular and CCTV evidence — not a substitute for either.

23. Real Research: What Has Actually Been Demonstrated?

The table below distils a representative cross-section of the research surveyed for this article, focused on what each study actually showed — and what it explicitly did not.

Table 6 — Current capability vs experimental research vs future possibility

Capability	Status	Evidence base
Device-free human presence detection via CSI	B — Field-tested	Demonstrated across multiple independent studies, including through-wall settings [12][13][14]
CSI-based activity/gesture/vital-sign sensing	A — Laboratory	Well-established survey literature; largely lab-validated [8][10]
RSSI-based indoor localization	C — Prototype	Metre-scale accuracy under calibration; degrades sharply otherwise [22][26]
Multi-sensor fused indoor localization	C — Prototype	Sub-metre accuracy reported, but only in tuned test environments [25]
RF hardware fingerprinting for device ID	A — Laboratory	Physically grounded, but generalisation/stability unresolved [1][5]
Defeating MAC randomization via probe-request fingerprinting	B — Field-tested	Repeatedly demonstrated by independent research groups [17][18][19]
IoT/smart-home cross-device timeline reconstruction	B — Field-tested	Demonstrated on specific device/vendor case studies [28][29]
Standardised Wi-Fi sensing (IEEE 802.11bf)	D — Commercially emerging	Published amendment (2025); defines a measurement framework, not an application [35][38]
Routine operational forensic use of RF/CSI evidence by police	Not established	No peer-reviewed or authoritative source in this research confirms routine operational deployment

24. Real-World Forensic or Law-Enforcement Applications

This section has to be the most restrained one in the article, because the honest finding is a narrow one. Network-layer Wi-Fi evidence — router logs, DHCP records, authentication timestamps — is used in routine digital-forensic and cybercrime investigations, in India and elsewhere, as one input among many, and this is well documented in the general digital-forensics and network-forensics literature. What is not supported by the research surveyed here is routine, courtroom-tested operational use of the more advanced techniques discussed in this article — CSI-based presence/movement sensing, RF hardware fingerprinting, or MAC-derandomization techniques — as standard law-enforcement practice. Published operational forensic examples for these specific advanced techniques remain limited. That is not a criticism of the science, which is active and often impressive; it reflects where the technology currently sits on the path from research demonstration to validated, court-ready forensic tool.

25. Indian Context

India's digital-forensics infrastructure is genuinely substantial, but the wireless/RF-specific slice of it is, at present, mostly educational and research-oriented rather than an operational specialty. The National Forensic Sciences University (NFSU) — an Institution of National Importance under the Ministry of Home Affairs, with campuses across Gandhinagar, Delhi, Goa, Bhopal, Bhubaneswar, Raipur and Jaipur — runs a School of Cyber Security and Digital Forensics offering coursework and certificate programmes covering mobile forensics, IoT security and forensics, and network forensics specifically, with direct institutional links to CERT-In and law-enforcement agencies [39]. This positions NFSU as the natural home for wireless-forensics research and training capacity in India, though the publicly available programme material surveyed for this article describes broad network- and IoT-forensics curricula rather than a dedicated CSI/RF-sensing forensic specialisation.

On the pure wireless-technology research side, institutions such as the Centre of Excellence in Wireless Technology (CEWiT) at IIT Madras conduct broadband and standards-track wireless research relevant to the underlying RF science, though not framed as forensic work [40]. Taken together, the Indian research and institutional base for this field exists and is growing, but this article did not find evidence of routine operational Wi-Fi/CSI/RF-forensic deployment by Indian police or forensic laboratories at the time of writing. That represents a genuine opportunity: as global research on CSI-based sensing and RF fingerprinting matures, India's dense forensic-education infrastructure — NFSU chief among it — is well placed to build validated, India-specific wireless-forensics capability rather than importing unvalidated tools wholesale.

26. Courtroom and Evidentiary Issues

None of the following is legal advice; it is a scientific description of what courts, in the U.S. tradition most extensively documented in this literature, have generally required before accepting novel technical evidence, via the Daubert standard established in Daubert v. Merrell Dow Pharmaceuticals (1993) and extended to technical (non-purely-scientific) expert testimony in Kumho Tire Co. v. Carmichael (1999) [31][32]. The recurring Daubert factors — has the method been tested, has it been peer-reviewed and published, is its error rate known, are there governing standards, is it generally accepted in the relevant scientific community — map uncomfortably well onto the gaps identified throughout this article.

Wireless/RF forensic techniques, taken as a group, currently satisfy some of these factors reasonably well (peer-reviewed publication is abundant) and struggle badly with others (known, courtroom-relevant error rates measured on independent, crime-scene-representative test data are largely absent; standardised methodology comparable to something like NIST's Computer Forensic Tool Testing programme for conventional digital forensics [33] or ISO/IEC 27037 for digital-evidence handling [34] does not yet exist specifically for CSI or RF-fingerprinting evidence). What would have to be demonstrated before RF evidence could become persuasive courtroom evidence, then, is fairly specific: published, independently reproduced error rates measured under conditions resembling real, uncontrolled crime scenes rather than tuned lab environments; documented chain-of-custody procedures for RF captures; and expert-witness consensus on interpretation standards comparable to what exists for DNA or fingerprint evidence today.

27. Privacy and Ethics

Everything that makes wireless sensing forensically interesting also makes it a genuine privacy concern, and the two cannot be discussed separately. Passive, device-free sensing means a person can, in principle, be detected without ever knowing they are being observed and without having done anything — connected to a network, carried a phone — that would ordinarily signal consent to monitoring. Techniques for defeating MAC randomization are, definitionally, techniques for circumventing a privacy protection users deliberately opted into [17].

The ethical line that matters here is the one between forensic investigation — targeted, warranted, retrospective examination of a specific event under legal authorisation — and continuous population surveillance, where the same underlying technology is repurposed to monitor ordinary people going about ordinary life. As Wi-Fi sensing becomes standardised and cheaper (Section 28), the gap between these two uses narrows technically even as it must be kept wide legally and institutionally. Data retention, informed consent, and the risk of false attribution — mistaking an innocent presence for a suspicious one — deserve as much attention in this field as the underlying signal-processing research does.

28. The Future of Wireless Forensics

The most concrete near-term development is the September 2025 publication of IEEE 802.11bf, the Wi-Fi Sensing amendment to the 802.11 standard [35]. It is worth being precise about what this standard actually does: it defines interoperable procedures for how compatible Wi-Fi devices discover sensing capability, negotiate a sensing session, and exchange measurement data — a shared language for CSI-like sensing across vendors, operating in both sub-7 GHz bands and the directional 60 GHz band [36][37]. It is a measurement framework, not an application; it does not itself decide what counts as "presence" or "an intruder," and it does not make every router a forensic sensor overnight [38]. But it does remove one of the biggest practical barriers to wider deployment — the need for research-grade hardware and vendor-specific CSI extraction tools — which is likely to accelerate commercial Wi-Fi-sensing products over the next several years.

Beyond 802.11bf, the research directions worth watching are AI-assisted RF classification aimed at improving cross-environment and cross-hardware generalisation (the stability problem flagged repeatedly in Sections 9 and 18), multi-sensor fusion combining Wi-Fi with other modalities, and tighter integration between IoT-forensic frameworks and network-layer evidence. All of this remains, honestly, on the research-to-early-commercial spectrum rather than the operational-forensic-practice end of it.

29. The Most Important Question

If Wi-Fi can sense movement, identify hardware, and estimate location, could it eventually become the invisible equivalent of CCTV? The honest answer is: it could become something adjacent to that, but probably never a replacement for it, and not soon. CCTV produces a visual record a human can directly interpret. Wireless sensing produces an abstract physical measurement that requires a trained model, a calibrated environment, and a chain of inference to become meaningful — every one of those steps is a place where error, bias, or manipulation can enter. What Wi-Fi sensing is more plausibly becoming is a background layer of ambient, low-resolution awareness — useful for corroboration, occupancy, and rough timelines — rather than a camera without a lens.

Conclusion

Return to the apartment from the opening of this article. Could today's investigators realistically use its wireless environment as evidence? Partially, and unevenly. If the router happened to log authentication events, and those logs survived, that is genuine, usable network-layer evidence — nothing exotic about it. If nobody was running a CSI capture at the time, the richer physical-layer story — who moved where, when — is almost certainly gone, because that information was never being recorded in the first place. And even where a wireless signature can be recovered, it establishes, at most, that a device was probably nearby — not who was holding it.

The radio environment around a crime scene may genuinely contain evidence. But turning a radio measurement into legally meaningful forensic evidence requires attribution, validation, uncertainty estimation, and independent corroboration — and for most of the techniques surveyed in this article, that chain is still being built in research laboratories, not yet standing in courtrooms.

Key Takeaways

• "Wi-Fi evidence" spans at least three distinct layers — network logs, signal measurements (RSSI/CSI), and physical-layer device fingerprints — and they have very different reliability profiles.
• Device-free CSI sensing can register human presence and movement, including through walls, but this is field-tested research, not routine forensic practice.
• RSSI-based localization is genuinely useful but typically metre-scale in accuracy at best, and only under prior site calibration a real crime scene never has.
• MAC address randomization can be partially defeated by probe-request fingerprinting and timing analysis, but this requires purpose-built capture at the time — not retrospective analysis of typical router logs.
• RF hardware fingerprinting is physically real but currently unstable across receivers, time, and environments.
• Presence evidence ("a device was likely here") is not identity evidence ("this person was here") — wireless data alone cannot bridge that gap.
• No source found in this research confirms routine operational use of CSI or RF-fingerprinting evidence by law enforcement, in India or elsewhere.
• IEEE 802.11bf (2025) standardises how Wi-Fi devices exchange sensing measurements — a framework, not a forensic tool by itself.

FAQs

Can Wi-Fi be used as forensic evidence?

Network-layer Wi-Fi data (router logs, authentication records) is already used as one input in digital investigations. More advanced signal-based techniques (CSI sensing, RF fingerprinting) are demonstrated in research but not established as routine forensic practice.

Can Wi-Fi reveal someone's location?

It can estimate rough location, typically with metre-scale uncertainty under favourable, pre-calibrated conditions. It cannot reliably pinpoint someone's exact location in an uninstrumented, real-world crime scene.

Can Wi-Fi detect a person without their phone connecting to the network?

Yes — device-free CSI sensing detects the physical disturbance a body causes to radio signals, independent of whether that person carries a connected device. This is demonstrated research, not standard investigative practice.

What is Wi-Fi Channel State Information?

A fine-grained measurement of how each subcarrier of a Wi-Fi signal's amplitude and phase changed as it travelled from transmitter to receiver, used in research to infer movement, presence, and other environmental changes.

Can Wi-Fi detect movement through walls?

Research has demonstrated this using CSI on commodity hardware, including sensors placed outside a building. Results depend heavily on wall material and system calibration and do not automatically generalise to new environments.

Can Wi-Fi identify a specific device?

Network identifiers like MAC addresses can identify a device if not randomized or spoofed. RF hardware fingerprinting can, in principle, identify a specific physical transmitter, but this remains largely laboratory-stage research.

Can Wi-Fi track someone indoors?

Indoor Wi-Fi positioning is an active, reasonably mature research field, but accuracy is generally metre-scale and depends on prior calibration of the specific space — conditions a real crime scene usually lacks.

What is RF fingerprinting?

A technique that identifies a specific wireless transmitter based on tiny, hardware-level manufacturing imperfections in its signal, rather than any software-assigned identifier.

Can MAC address randomization prevent Wi-Fi tracking?

It significantly raises the bar, but research has shown it can be partially defeated through probe-request content analysis and timing-pattern fingerprinting, given purpose-built capture equipment operating at the time.

Can Wi-Fi evidence be spoofed?

Yes. MAC addresses, network identities, and even (in research settings) RF hardware fingerprints can be manipulated, which is why independent corroboration matters for any wireless-based finding.

Can routers provide evidence in criminal investigations?

Yes, when logs exist and are preserved — authentication times, DHCP records, and connected-device lists are conventional, usable digital evidence, subject to the same integrity requirements as any other log.

Can Wi-Fi reveal where a phone was?

Only approximately, and only if the phone connected to or was actively probing a monitored network at the time, with usable RSSI or CSI data captured and retained — which is uncommon by default.

Can Wi-Fi determine who was holding a device?

No. Wireless signals indicate device presence, not personal identity. Establishing who was holding a device requires separate, corroborating evidence.

Is wireless forensic evidence admissible in court?

This depends on jurisdiction and the specific technique. Courts generally apply reliability standards such as Daubert, which require known error rates, peer review, and general scientific acceptance — thresholds most advanced wireless-sensing techniques have not yet cleared for forensic use.

How accurate is Wi-Fi localization?

Published studies commonly report roughly one to several metres of error under calibrated conditions, with some fused multi-sensor systems reporting sub-metre accuracy in tuned test environments.

Can Wi-Fi replace GPS?

No — they are complementary. Wi-Fi is useful indoors where GPS fails, but depends on existing infrastructure and prior calibration that GPS does not require outdoors.

Is Wi-Fi sensing currently used by police?

This research did not find evidence of routine operational use of CSI-based sensing or RF fingerprinting by law-enforcement agencies, in India or internationally; network-layer log analysis is more established.

What is the future of wireless forensics?

The 2025 IEEE 802.11bf standard is likely to accelerate commercial Wi-Fi sensing products, which may eventually create more standardised, better-validated data sources for forensic use — but this remains an emerging area.

Suggested Internal Links

• Mobile Device Forensics — [Suggested future BFE article]
• Digital Evidence: Foundations and Standards — [Suggested future BFE article]
• Cybercrime Investigation in India — [Suggested future BFE article]
• Smartphone Forensics: Extraction and Analysis — [Suggested future BFE article]
• IoT Forensics: Evidence from Smart Devices — [Suggested future BFE article]
• CCTV Forensics and Video Evidence Authentication — [Suggested future BFE article]
• Crime Scene Reconstruction: Principles and Methods — [Suggested future BFE article]
• Geolocation Forensics: Cell Towers, GPS and Beyond — [Suggested future BFE article]
• Network Forensics: Logs, Packets and Investigations — [Suggested future BFE article]
• Digital Evidence in Indian Courts — [Suggested future BFE article]
• Forensic Evidence Reliability and the Daubert Standard — [Suggested future BFE article]
• AI in Forensic Science: Promise and Pitfalls — [Suggested future BFE article]

Infographic Ideas

1. What a Wi-Fi crime scene looks like — Concept: floor-plan cutaway showing router, smart devices, and invisible signal cones radiating through walls. Labels: AP, connected devices, probe activity zone, signal attenuation gradient. Dimensions: 1200×1500px.

2. How radio waves interact with a building — Concept: cross-section showing reflection, diffraction, attenuation, multipath as a signal crosses a room. Labels: direct path, reflected path, diffracted path, attenuated path. Dimensions: 1400×900px.

3. What CSI actually measures — Concept: waveform split into subcarriers with amplitude/phase call-outs before and after a person walks through. Labels: subcarrier 1–n, amplitude shift, phase shift. Dimensions: 1200×1200px.

4. How Wi-Fi localization works — Concept: side-by-side trilateration circles vs. fingerprint-map grid. Labels: AP1/AP2/AP3, distance estimate, reference points, best match. Dimensions: 1400×1000px.

5. RSSI vs CSI — Concept: single bar (RSSI) vs. multi-line spectrum (CSI) comparison. Labels: single value, per-subcarrier resolution, information richness. Dimensions: 1200×800px.

6. RF fingerprinting — Concept: zoomed-in waveform showing oscillator drift and I/Q imbalance as a unique "signature." Labels: carrier offset, I/Q imbalance, amplifier nonlinearity. Dimensions: 1200×900px.

7. Wi-Fi evidence timeline — Concept: horizontal timeline showing what data typically survives at 1 hour, 1 day, 1 week, 1 month post-event. Labels per evidence type from Table 1. Dimensions: 1600×700px.

8. Wi-Fi vs GPS vs cellular — Concept: three-column comparison icons (indoor building / satellite / cell tower) with range and accuracy bars. Dimensions: 1400×900px.

9. How walls and furniture distort RF evidence — Concept: same room shown twice — empty vs furnished — with signal-path distortion overlay. Dimensions: 1400×1000px.

10. From radio signal to courtroom evidence — Concept: funnel diagram — raw signal → measurement → feature extraction → inference → corroboration → courtroom threshold. Dimensions: 1200×1600px.

References

Peer-Reviewed / Foundational Research

• [1] Cobb, W.E., Laspe, E.D., Baldwin, R.O., Temple, M.A., Kim, Y.C. (2012). Intrinsic physical-layer authentication of integrated circuits. IEEE Transactions on Information Forensics and Security, 7(1), 14–24.
• [2] Yuan, H.L., Hu, A.Q. (2010). Preamble-based detection of Wi-Fi transmitter RF fingerprints. Electronics Letters, 46(16), 1165–1167.
• [8] Ma, Y., Zhou, G., Wang, S. (2019). WiFi sensing with channel state information: a survey. ACM Computing Surveys, 52(3). DOI: 10.1145/3310194
• [9] Wang, J., Gao, Q., Pan, M., Fang, Y. (2018). Device-free wireless sensing: challenges, opportunities, and applications. IEEE Network, 32(2), 132–137. DOI: 10.1109/MNET.2017.1700133
• [10] Wang, Z., Guo, B., Yu, Z., Zhou, X. (2018). Wi-Fi CSI-based behavior recognition: from signals and actions to activities. IEEE Communications Magazine, 56(5), 109–115. DOI: 10.1109/MCOM.2018.1700144
• [11] Yang, J., Zou, H., Jiang, H., Xie, L. (2018). Device-free occupant activity sensing using WiFi-enabled IoT devices for smart homes. IEEE Internet of Things Journal, 5(5), 3991–4002. DOI: 10.1109/JIOT.2018.2849655
• [17] Vanhoef, M., Matte, C., Cunche, M., Cardoso, L.S., Piessens, F. (2016). Why MAC address randomization is not enough: an analysis of Wi-Fi network discovery mechanisms. Proceedings of the 11th ACM Asia Conference on Computer and Communications Security (ASIA CCS '16). DOI: 10.1145/2897845.2897883
• [31] Daubert v. Merrell Dow Pharmaceuticals, Inc., 509 U.S. 579 (1993).
• [32] Kumho Tire Co. v. Carmichael, 526 U.S. 137 (1999).
• [36] Meneghello, F., Chen, C., Cordeiro, C., Restuccia, F. (2023). Toward integrated sensing and communications in IEEE 802.11bf Wi-Fi networks. IEEE Communications Magazine, 61(7), 128–133.
• [37] Blandino, S., Ropitault, T., da Silva, C.R., Sahoo, A., Golmie, N. (2023). IEEE 802.11bf DMG sensing: enabling high-resolution mmWave Wi-Fi sensing. IEEE Open Journal of Vehicular Technology, 4, 342–355.

Conference / Recent Technical Research (2018–2026)

• [3] Radio Frequency Fingerprinting via Deep Learning: Challenges and Opportunities. arXiv:2310.16406.
• [4] Erasing Radio Frequency Fingerprinting via Active Adversarial Perturbation. arXiv:2406.07349 (2024).
• [5] Cross-Receiver Generalization for RF Fingerprint Identification via Feature Disentanglement and Adversarial Training. arXiv:2510.09405.
• [6] SMoRFFI: A Large-Scale Same-Model 2.4 GHz Wi-Fi Dataset and Reproducible Framework for RF Fingerprinting. arXiv:2511.07770.
• [12] TwSense: Highly Robust Through-the-Wall Human Detection Method Based on COTS Wi-Fi Device. Applied Sciences, 13(17), 9668 (2023). MDPI.
• [13] One-Sided CSI-Based Sensing in Adversarial Through-Wall Settings. Springer Nature Link chapter (2025/2026).
• [14] CRONOS: Colorization and Contrastive Learning for Device-Free NLoS Human Presence Detection using Wi-Fi CSI. arXiv:2211.10354.
• [15] WiFi-based human activity recognition through wall using deep learning. Engineering Applications of Artificial Intelligence, ScienceDirect (2023).
• [16] Attention-Enhanced Deep Learning for Device-Free Through-the-Wall Presence Detection Using Indoor WiFi Systems. arXiv:2304.13105.
• [18] Martin, J. et al. (2017/2024). A Study of MAC Address Randomization in Mobile Devices and When it Fails. arXiv:1703.02874.
• [19] Persistent Device Identity for Network Access Control in the Era of MAC Address Randomization: A RADIUS-Based Framework. arXiv:2603.16745.
• [20] Compact Probe Request Fingerprinting with Asymmetric Pairwise Boosting: Efficient Association of Wi-Fi Probe Requests under MAC Address Randomization.
• [21] MAC address de-randomization for WiFi device counting: Combining temporal- and content-based fingerprints (2022).
• [22] RSSI Fingerprint-Based Indoor Localization Solutions Using Machine Learning Algorithms: A Comprehensive Review. Journal of Sensor and Actuator Networks, 8(5), 153 (2025). MDPI.
• [23] A Robust and Accurate Indoor Localization Using Learning-Based Fusion of Wi-Fi RTT and RSSI. NCBI/PMC9002808.
• [24] Hoang, M.T., Yuen, B., Dong, X., Lu, T., Westendorp, R., Reddy, K. Recurrent Neural Networks for Accurate RSSI Indoor Localization. arXiv:1903.11703.
• [25] EKF-Based Fusion of Wi-Fi/LiDAR/IMU for Indoor Localization and Navigation. arXiv:2509.23118 (2025).
• [26] Wi-Fi based indoor localization using trilateration and fingerprinting methods (Kalman filter + Convolutional Autoencoder). ResearchGate (2019).
• [27] Smart Home IoT Forensics in Matter Ecosystems: A Data Extraction Method Using Multi-Admin. Electronics, 15(4), 884. MDPI (2026).
• [28] Digital Forensics Investigation on Xiaomi Smart Router Using SNI ISO/IEC 27037:2014 and NIST SP 800-86 Framework. Atlantis Press (2021).
• [29] A Layered Digital Investigation Framework for Internet of Things (IoT) Forensics: A Smart Home Camera Case Study (2026).
• [30] IoT Forensic — A digital investigation framework for IoT systems. arXiv:1909.02815.
• [35] IEEE 802.11bf-2025, WLAN Sensing amendment to IEEE 802.11-2024. Published September 26, 2025.
• [38] An Overview on IEEE 802.11bf: WLAN Sensing. IEEE Communications Surveys & Tutorials (2024). DOI: 10.1109/COMST.2024.3408899

Government / Standards / Institutional Sources

• [33] National Institute of Standards and Technology (NIST). Computer Forensic Tool Testing (CFTT) Program.
• [34] ISO/IEC 27037:2012 — Guidelines for identification, collection, acquisition, and preservation of digital evidence.
• [39] National Forensic Sciences University (NFSU), Institution of National Importance, Ministry of Home Affairs, Government of India — School of Cyber Security and Digital Forensics; Certificate Course on Network Forensics.
• [40] Centre of Excellence in Wireless Technology (CEWiT), IIT Madras Research Park, Chennai.

Note on sourcing: every reference above was independently located and verified through publisher pages, arXiv, ACM/IEEE listings, or institutional sites during research for this article. This bibliography deliberately stops short of the widest possible source count rather than pad it with unverifiable or tangential material — in line with BFE's standing no-fabrication editorial policy.