He FBI accessed deleted messages from signal on an iPhone through a little-known mechanism. The technique was based on the notification history that the device saves locally.
The case was reported by the specialized media 404Medium. The report detailed a procedure for forensic extraction applied to one of the most complex telephones for the authorities.
Method takes advantage of weakness in notifications
The analysis focused on the iPhone push notifications. This system stores copies of incoming messages on the device itself.
Investigators managed to recover the contents. This occurred even after the messages were deleted and the Signal app was removed from the phone.
Access was possible because the notifications showed the entire message. The application settings did not limit the information visible on the screen.
Investigation is linked to criminal case
The intervention was part of a recent judicial process. The objective was to obtain messages from an accused for launching fireworks at an ICE detention centervandalize property and shoot a police officer.
During the trial, people present indicated that the FBI explained the technique used to recover the data.
The iPhone often makes it difficult to obtain digital evidence. This is due to systems such as Secure Enclavedevice locking and advanced security features.
Mechanisms such as passwords per application, hiding of apps and automatic restarts due to inactivity also play a role.
Signal setup was key
Signal offers options to control the content of notifications. The user can choose between displaying:
- Contact name and message
- Just the name
- No data
In this case, the configuration allowed the full text will be visible in notifications. This facilitated his later recovery.
*The creation of this content was assisted by artificial intelligence. The source of this information is from a news agency and reviewed by an editor to ensure accuracy. The content was not generated automatically.
