Deleted Signal messages extracted
Reports say the FBI was able to recover deleted Signal messages from iPhone notification data stored locally on devices, even after the app was removed. Analysts stress the recovery relied on notification previews and local device data rather than a break of Signal's encryption. (hackread.com, andreafortuna.org)
A disappearing message in Signal can still leave a copy behind on an iPhone if the phone shows the message in a notification preview. (404media.co) That is the gap investigators used in a federal case tied to the July 2025 attack on the Prairieland Detention Facility in Alvarado, Texas. 404 Media reported on April 9, 2026 that the Federal Bureau of Investigation recovered incoming Signal messages from defendant Lynette Sharp’s iPhone after the app had been deleted. (404media.co) The messages were not pulled from Signal’s encrypted chat database or from Signal’s servers. They were recovered from Apple’s notification storage on the device, where iPhone alerts can keep readable snippets that were shown on screen. (404media.co, forbes.com) In plain terms, end-to-end encryption protects a message while it travels between devices and while the app stores it in encrypted form. A lock-screen preview is different: it is the operating system showing text outside the app, and that text can become separate local data. (forbes.com, support.apple.com) Apple says iPhone users can choose whether notifications show previews on the Lock Screen, including an “Always” option that displays contents without unlocking the phone. Apple also says users can change notification settings for individual apps in Settings. (support.apple.com, support.apple.com) Signal says iPhone users can change what appears in a Signal alert by going to Settings, then Notifications, then Show. The app offers options including “Name, Content, and Actions” and “Name only,” which limits how much text is exposed in a notification. (support.signal.org) The reported recovery appears to have been limited to incoming messages, because those are the ones that generate notification previews on the receiving phone. Outgoing messages would not usually be preserved the same way in the device’s notification records. (forbes.com, techspot.com) This is not a Signal-only issue. Any app that puts message text into iPhone notifications can create the same kind of local trace, because the weak point is the operating system’s preview feature, not the app’s encryption. (forbes.com, 9to5mac.com) The practical fix is simple and old-fashioned: stop showing message text in notifications if the content matters. If the preview never appears on the screen, there is far less plain-language text for a forensic tool to recover later. (support.signal.org, support.apple.com)
