You can use a non-linear junction detector, and triangulate on the signal it forces the target radio to give off. They are not very selective, so it’s easier to track when there are very few radios in the area under illumination.

The easier way is to compromise the phone and have it pretend to be off.