How to check if airplane mode was activated in a specific time in the past?

[LuckyScooby]

Hey, guys!

I have an employee and we need to track ourselves via Google Maps location sharing.
However, on two consecutive Fridays (last ones) his phone went totally offline during the same period (12:00pm to 4:00pm), no messages were arriving, no GPS, no calls, nothing.
He claims it certainly was a network problem, but I'm not buying that since it always works at the location he was supposed to be.
Unfortunately I have no other way of confirming that.

If my theory is right, is there any possible way of getting to know if the airplane mode was triggered at that time?
Maybe through system logging or other means?
Obs.: The phone he uses is not rooted, but if there is any way through rooting I'd also like to read you.

Please, this is very important to me and for my business itself, I thank you in advance.

 

[LuckyScooby]

UPDATE:
I researched for logcat and found the following command here.
adb logcat -b radio View the buffer that contains radio/telephony related messages.

Tested it on my own phone and it works great; tells me exactly what I need.

The problem now is:
It shows a record of a very small time frame, last time I rebooted it was days ago, yet I could only see logs from up to 2 hours ago.

 

[bcrichster]

What makes you think it was specifically airplane mode? It could've been a reboot or phone battery died situation

 

[lunatic59]

If you have developer options enabled on the target phone you can go into developer settings and increase the size of the log buffer (up to 16M on my phone) and that should increase how much data is captured.

 

[lunatic59]

What makes you think it was specifically airplane mode?

Because all employees play the system.

We are required by law to log our (truck) driver's hours and routes and if they go offline for any reason, it's a big deal up to and including termination.

 

[LuckyScooby]

What makes you think it was specifically airplane mode? It could've been a reboot or phone battery died situation

Because I already know his phone routine:
- When he gets back around 6:00pm his battery is always near 50%, we fully charge and check our phones every morning (battery and GPS);
- Everyday from 12:00pm to 4:00pm he is supposed to be in a specific location and everyday his GPS and connectivity works pretty fine at that site with no delays and very high accuracy.

Then one Friday he says he is going to the referred location and his phone blacks out for entire 4 hours, then he comes online and says everything is fine and is heading back to office, then the same happens on the next Friday (last one) at the very same time period.

SMS, GPS, calls, WhatsApp .. nothing worked and nothing arrived.
I do believe it's not a coincidence and entirely disappearing from the network is a job for the airplane mode, specially when and where it always worked before.

 

[bcrichster]

Ooh.. I see. Tried to play devil's advocate but I'll just shut up now, Lol.

 

[LuckyScooby]

I've written a simple shell script to run from Terminal Emulator.
It uses getprop and grep to retrieve persist.radio.airplane_mode_on as well as some other telephony related properties, wifi is also present.
Been testing on my own phone and the loop works pretty well also logging date/time along with these specific variables every 1 minute.
It's been running for 24h+ now and using less than 300kb at the time.
I'll post it here soon for anyone who finds it useful.

Do you think I should warn him about it, just for him to know I'm not stupid and he is being monitored from now on?
Or should I let him to think I'm blind and eventually catch him on the fly?

 

[lunatic59]

There are two things to consider here. First what are the laws of your region? You might have to consult the company's lawyer to find out. Some areas require full disclosure to any employee who's being tracked or monitored. The second is what are the consequences of getting caught switching off the phone?

Personally, as long as it was legally okay, i'd not tell him and then check the logs when/if he drops off the radar. If you do see the phone being put into airplane mode (or the equivalent) then I'd let him know he was caught and warn him that this is a one-time warning. Next time it's hasta la vista, baby.

 

[svim]

Just to clarify, this mobile device is company-owned and not his personal phone, yes?

As for notifying him before-hand, is this a matter of you want to get this employee to just do his job or do you want to set him up to fail? Just my opinion but I think he deserves to know what's going on. We all make mistakes and we all have made stupid judgement calls. We all also deserve a second chance, within reason of course.
On the other hand, if you have warned him before about goofing off on company time and this is just another incident you've caught him doing, that's a different situation. At least by building up documentation, like logging his online tracking (or lack of), you have a more solid basis to take action. If this is a union-protected job for instance, it's harder to just demote or fire someone without evidence of an problem.

 

[LuckyScooby]

It is company provided and he agreed upon contract that he would be monitored primarily by GPS and any other necessary means the company decides, limited to the phone itself, of course.

I really don't want to set him up, but also I cannot invest in someone who tricks the business and what happened is a clear sign of that possibility.
Actually I've talked to him twice about the failure (after the second one) and he just said it could have been a network error; the second time I mentioned he kept silent, so he already knows the situation.

So, I decided not to warn him about the monitoring script; instead we will change his phone by tomorrow morning for a brand new model and updated Android version.
I'll log his new phone and, if he is really manipulating the radio, then I'll go deeper with the investigation efforts until I get an indisputable proof.

I do hope I'm chasing ghosts, he is damn good with his job.

By the way, this is the script I promised you:

# Set hidden directory
cd /storage/emulated/0
mkdir .radiostats
cd .radiostats

# Main loop
while true; do
printf "\n" >> log.dat
date >> log.dat
acpi >> log.dat
getprop | grep gsm.network.type >> log.dat
getprop | grep persist.radio.airplane_mode_on >> log.dat
ifconfig wlan0 | grep addr >> log.dat
sync
sleep 1m
done

acpi reports battery level and ifconfig wlan0 will report if wifi has an IP (i.e. connected).
gsm.network.type reports the connectivity technology (HSPA, HSPA+, ..., or Unknown if mobile data is turned off).

 

[svim]

Have you implemented some sort of 'mobile device management' solution like Google's G Suite?
https://gsuite.google.com/products/admin/mobile/
This will give you a lot of control remotely over your company's mobile devices, preventing the staff from doing things like disabling mobile data:
https://www.manageengine.com/mobile...vice_management/mdm_android_restrictions.html

As for employee X, never mind on my previous soapbox rant on employee rights. Respect goes both ways and since you've brought the issue up to him more than once, apparently he's got some entitlement issues along with being a valuable worker. Best of luck to you navigating through that kind of situation.

 

[LuckyScooby]

Just for a matter of curiosity, he was caught today.

Last Friday I insisted in having a third and more particular conversation with him about what happened and that we were investigating the causes. Then he told me it could have been because he left his phone in the metal cabinet (that information was new) and that the metal could have caused the interference and blackout.

It didn't happen this Friday as I expected a liar to be withdrawn by fear.
So I asked him today to leave his phone again in the same cabinet for a specific amount of time.
It blacked out!

By an hour ago I asked him to come back to our office and checked the script's log and found out the airplane mode was triggered both the moment he put it in and when he got it out.

Conclusion is, he did it on purpose now to reproduce and confirm the failure he claimed before, which was not a failure but clearly intentional, he just didn't know the script was there this time.

We had a good conversation after that, and he affirms he's regretful (though I don't think so).
But I will let that one pass since from tomorrow on I will be accompanying him myself.

I'm looking forward on deploying a mobile management solution, as @svim stated.
Thank you all for you time.

 

[svim]

Wow, that metal cabinet scenario is a really interesting twist. Never would have guessed something like that was involved.
Best of luck getting this all sorted out, management and people-skills don't get enough credit in a lot of situations.

 

[Begin]

Hi Lucky Scoober and everyone. I'm having a similar problem. I need to know the airplane mode history (when it entered and when it exited) for a specific date in the past month. I already activated debugging and installed android studio. but I am not able to move forward.
Can you help me?

 

[screenshot]

how can i download the log file instead of looking at the white text in a small black box and which line would show when the AP mode has been switched on?