The correct answer is C because Faraday isolation directly addresses the threat described in the question:
remote alteration through wireless communication. Mobile devices can still receive network commands, wipes, synchronization changes, or other signal-triggered activity after seizure unless radio communications are blocked. Guidance from the U.S. Department of Justice states that Faraday isolation bags are used to prevent mobile phones and devices from connecting to communication signals. That makes this the most direct preservation measure for preventing remote changes. Option A is an important general forensic practice, but it does not stop wireless communication to a still-active mobile device. Option B concerns environmental storage conditions, and option D supports integrity verification after collection, but neither blocks remote access. CHFI v11 includes evidence preservation, first response, and mobile forensics processes, all of which require examiners to recognize how to secure live mobile devices against external interference. When the risk is remote signal-based tampering, the best immediate mitigation is to isolate the device from communications using a Faraday bag or equivalent shielding.