Forensic Recovery of Deleted Signal Data via iOS Notification Database (heise.de)

• Signal messages recovered after complete app removal.
• Exploitation of iOS KnowledgeC database for data extraction.
• System-level notification caching bypasses end-to-end privacy.

"FBI forensic teams successfully retrieved Signal messages from an iOS device despite the user having deleted the application. The recovery did not target the encrypted app database, but rather exploited the iOS notification cache (KnowledgeC), which retains remnants of incoming notifications including message previews. This method demonstrates how system-level caching creates persistent data logs that undermine application-layer encryption. The findings highlight significant privacy risks in iOS architecture, where volatile messaging data becomes permanent forensic evidence through background system processes, regardless of user attempts to wipe data."