y’all have your #Signal notifications set to “Name Only” or “No Name or Content”, right…? 🤔
**FBI Extracts Suspect’s Deleted Signal Messages Saved in iPhone Notification Database**
*“The #FBI was able to forensically extract copies of incoming Signal messages from a defendant’s #iPhone, even after the app was deleted, because copies of the content were saved in the device’s push notification database”*
💰 https://www.404media.co/fbi-extracts-suspects-deleted-signal-messages-saved-in-iphone-notification-database-2/
a detailed write-up that’s not paywalled 👇
**When deleting Signal is not enough: the FBI, iPhone notifications, and what #forensics can reveal**
*”A few days ago, 404 Media published a detailed report that made a lot of people uncomfortable: the FBI managed to recover Signal messages from a suspect’s iPhone, even though the app had already been uninstalled.* ***No #encryption was broken. No Signal server was compromised.*** *The messages were sitting in the phone’s own notification database, waiting to be found.”*
https://andreafortuna.org/2026/04/11/signal-fbi-iphone-notifications-forensics/
#DFIR
#iOS
itgrrl :donor:
npub14n…n7m6a
2026-04-16 03:30:02 UTC
Author Public Key
npub14nfjt46d9q6f3cz3z4lny2jnt8xa5cvrlpyknnp9s60ye9jqhuvs9n7m6aSeen on
wss://relay.momostr.pinkPublished at
2026-04-16 03:30:02 UTCEvent JSON
{
"id": "2c3adf418557a7ecef96ebe8e33a23009ee80c73992e0f1a6460476dfa77acd2",
"pubkey": "acd325d74d283498e051157f322a5359cdda6183f84969cc25869e4c9640bf19",
"created_at": 1776310202,
"kind": 1,
"tags": [
[
"t",
"forensics"
],
[
"t",
"iphone"
],
[
"t",
"fbi"
],
[
"t",
"dfir"
],
[
"t",
"ios"
],
[
"t",
"encryption"
],
[
"t",
"signal"
],
[
"proxy",
"https://infosec.exchange/@itgrrl/116412265410857455",
"web"
],
[
"proxy",
"https://infosec.exchange/users/itgrrl/statuses/116412265410857455",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/itgrrl/statuses/116412265410857455",
"pink.momostr"
],
[
"-"
]
],
"content": "y’all have your #Signal notifications set to “Name Only” or “No Name or Content”, right…? 🤔 \n\n**FBI Extracts Suspect’s Deleted Signal Messages Saved in iPhone Notification Database** \n\n*“The #FBI was able to forensically extract copies of incoming Signal messages from a defendant’s #iPhone, even after the app was deleted, because copies of the content were saved in the device’s push notification database”* \n\n💰 https://www.404media.co/fbi-extracts-suspects-deleted-signal-messages-saved-in-iphone-notification-database-2/\n\na detailed write-up that’s not paywalled 👇 \n\n**When deleting Signal is not enough: the FBI, iPhone notifications, and what #forensics can reveal** \n\n*”A few days ago, 404 Media published a detailed report that made a lot of people uncomfortable: the FBI managed to recover Signal messages from a suspect’s iPhone, even though the app had already been uninstalled.* ***No #encryption was broken. No Signal server was compromised.*** *The messages were sitting in the phone’s own notification database, waiting to be found.”* \n\nhttps://andreafortuna.org/2026/04/11/signal-fbi-iphone-notifications-forensics/ \n\n#DFIR \n#iOS ",
"sig": "a20eb54effbd779a4c4558ff7111930bfa5d86490286f146806b0cf60fa99ee985c9ffa88841dd490691af1c928ab88a5fb0e9d7687a37a38f93db02cd168c37"
}