IN a Texas FBI case, iPhone forensics revealed that Signal messages could be recovered even after the app was removed, via system artifacts rather than by breaking Signal’s encryption. The claim, reported by 404 Media and discussed by security researchers, shows that copies of incoming Signal messages were found in the device’s push notification database after uninstalling the app.
Investigators recovered only incoming messages, not outgoing ones, because incoming messages are processed by Apple’s push notification system and may leave traces in the OS, whereas outgoing messages do not follow that pathway. The article explains that iOS stores notification data in system databases and caches that persist beyond app deletion, enabling forensic recovery from the device.
It notes that forensic tools analyse OS-decrypted data, such as notification content, and that more data becomes accessible after first unlock or via backups, with potential use of tools like Cellebrite UFED or Magnet AXIOM or iCloud backups. The piece concludes that disappearance of messages in an app does not guarantee their disappearance from the phone, challenging common privacy assumptions. according to 404 Media.