FBI Forensics Recovered Deleted Signal Message Fragments from iPhone Notifications
Summary
FBI forensic extraction reportedly recovered incoming Signal message fragments from an iPhone’s notification database, even after Signal was removed. The article says the source was notification previews, not Signal’s encrypted storage.
Key points
- In the Prairieland ICE Detention Facility case, FBI investigators reportedly recovered incoming Signal message fragments from an iPhone’s notification storage, even after the app was removed.
- The fragments came from iOS notification previews, not Signal’s encrypted database, and may persist after messages disappear in the app.
- According to courtroom testimony cited in the article, this method recovered incoming messages, not outgoing ones.
- The article notes that other messaging apps with notification previews may leave message snippets in iOS storage.
- Disabling message previews or hiding message content in notification settings can reduce the sensitive information stored in notifications.
- The article cites AuRevoir as a free, open-source utility for removing cached messages from macOS’s notification database.
Article Details
- Event Type
- Forensic recovery of deleted Signal message fragments from iOS notification storage during a federal trial.
- Impact
- Investigators recovered fragments of incoming Signal messages from notification previews stored on an iPhone, even after Signal was removed. According to FBI Special Agent Clark Wiethorn's courtroom testimony, this method recovered incoming messages only; outgoing messages were not captured. The article attributes the exposure to iOS notification handling, not a flaw in Signal's encryption.
People
Clark WiethornFBI Special Agent whose courtroom testimony described recovery of incoming Signal message fragments and the absence of recovered outgoing messages.Lynette SharpThe article reports that notification-based message remnants were extracted from her phone during the Prairieland ICE Detention Facility investigation.Patrick WardleFounder of Object-See Foundations who developed AuRevoir, a free tool described as removing cached messages from macOS's notification database.
Vendors
Products
iOSDeleted Signal messages can sometimes be recovered from an iPhone because iOS stores notification previews in a system-level database rather than from Signal’s encrypted storage.iPhoneDeleted Signal messages can sometimes be recovered from an iPhone because iOS stores notification previews in a system-level database rather than from Signal’s encrypted storage.SignalDeleted Signal messages can sometimes be recovered from an iPhone because iOS stores notification previews in a system-level database rather than from Signal’s encrypted storage.