FBI Recovers Deleted Signal Messages from iPhone Notifications

In a surprising revelation, the FBI managed to retrieve deleted Signal messages from an iPhone by accessing the device's notification database. This breakthrough came to light during a trial involving vandalism at the ICE Prairieland Detention Facility in Texas. The FBI extracted incoming Signal messages from Lynette Sharp's iPhone, even though the app had been uninstalled. This was possible because the messages were stored in Apple's internal notification storage, a feature that retains incoming notifications even after app deletion. However, only incoming messages were captured, as outgoing ones were not stored.

The case highlights a crucial aspect of iOS's data handling: notifications can be preserved if the message preview setting is not disabled. This means that even if an app is removed, its notifications might still be accessible. The FBI's method remains unclear due to the lack of technical details about the iPhone's condition, but it underscores the complexity of iOS's security states, such as BFU and AFU modes, which affect data access.

Additionally, the persistence of push notification tokens after app deletion plays a role. These tokens aren't immediately invalidated, allowing servers to continue sending notifications. This could explain how the FBI accessed the messages, possibly through a device backup using commercially available tools that exploit iOS vulnerabilities.

Interestingly, Apple recently updated iOS to change how it validates push notification tokens, though it's uncertain if this is related to the case. This development raises questions about the balance between user privacy and law enforcement's ability to access data.

The case serves as a reminder of the intricate security mechanisms within iOS and the potential for data recovery even after app deletion, emphasizing the need for users to be aware of their notification settings.