This week I examined a forensic trace that is often underestimated in mobile analysis: the moment a user manually enables or disables Airplane Mode. With the release of iOS 26 Beta 1, the Apple Unified Log now provides clear and timestamped visibility into this specific action.

Why is this relevant? Because enabling Airplane Mode is not a passive system event. It is almost always the result of deliberate user interaction. Whether to avoid tracking, cut off communication, or trigger a controlled acquisition, this action can be forensically meaningful.

In iOS 26 Beta 1, Airplane Mode status is logged with precise system-level detail. Below are the two relevant artifacts captured in a test sequence.

Artifact: Airplane Mode Enabled

2025-07-04 14:16:40.247614+0200  localhost SpringBoard[35]: (CoreTelephony) [com.apple.CoreTelephony:Packet] Calling _CTServerConnectionGetCellularDataSettings(): isCapable = 0 isEnabled = 1 isAirplaneMode = 1

Timestamp: 2025-07-04 14:16:40.247614 (UTC+2)
Process: SpringBoard
Subsystem: CoreTelephony
EventMessage:
Calling _CTServerConnectionGetCellularDataSettings(): isCapable = 0 isEnabled = 1 isAirplaneMode = 1
→ This log entry confirms that Airplane Mode was turned ON. The key indicator is isAirplaneMode = 1, meaning cellular radios were disabled. However, as shown in the next section, Bluetooth remained active.

Artifact: Airplane Mode Disabled

2025-07-04 14:16:56.189761+0200  localhost wifid[54]: (CoreTelephony) [com.apple.CoreTelephony:Packet] Calling _CTServerConnectionGetCellularDataSettings(): isCapable = 0 isEnabled = 1 isAirplaneMode = 0

Timestamp: 2025-07-04 14:16:56.189761 (UTC+2)
Process: wifid
Subsystem: CoreTelephony
EventMessage:
Calling _CTServerConnectionGetCellularDataSettings(): isCapable = 0 isEnabled = 1 isAirplaneMode = 0
→ This confirms that Airplane Mode was turned OFF. Cellular services are now allowed, although the device still reports no current radio capability (isCapable = 0). (There was no SIM active)

Bluetooth Scanning During Airplane Mode

An unexpected observation during testing on an iPhone 12 running iOS 26 Beta 1: Bluetooth was not disabled when Airplane Mode was enabled. Instead, background Bluetooth Low Energy scans continued.

2025-07-04 14:16:40.251148+0200  localhost bluetoothd[99]: [com.apple.bluetooth:Server.LE.Scan] ScanParams: numScanAgents 5, combined params AD:1 RD:0 AS:0 PHYS:1 MSL:4 (30/300) PSV:0 Rg:0 Cri:0 pBT:0 pWiFi:0 pCfg:0 type:0
2025-07-04 

Timestamp: 2025-07-04 14:16:40.251148 (UTC+2)
Process: bluetoothd
Subsystem: Server.LE.Scan
EventMessage:
ScanParams: numScanAgents 5, combined params …

This confirms that multiple system services (e.g. sharingd, locationd, CBDaemon) continued scanning in passive BLE mode. This behavior is new. In earlier iOS versions, Airplane Mode typically disabled Bluetooth unless the user manually re-enabled it.

To verify the log data, I manually checked the GUI on the test device (iPhone 12, iOS 26 beta 1). After enabling Airplane Mode via Control Center, I confirmed that Bluetooth remained active in the system settings. This matched the Unified Log output and confirmed that the interface no longer disables Bluetooth by default when Airplane Mode is toggled.

Forensic Relevance

The activation of Airplane Mode is an intentional action that can disrupt or delay communication, location services, and logging behavior. In investigative timelines, these artifacts can be used to:

• Correlate with unlocks or app usage
• Detect user intent to isolate the device
• Anchor the start or end of a data gap
• Identify hidden Bluetooth activity despite Airplane Mode being visually active

With iOS 26, these events are now more clearly and reliably recorded in the Unified Log — and that makes them a valuable signal in mobile forensic workflows.

Happy hunting!