FBI recovers deleted Signal messages from iPhone notification database

The FBI has successfully recovered private Signal messages from a defendant's iPhone, even after the app was deleted, revealing a potential security loophole in how iPhones handle message notifications. This discovery was made during a court case in Texas, highlighting that deleted messages may persist longer than expected in the phone's memory, with further coverage provided by HackRead.

In a Texas court case in April 2026, the FBI presented evidence of recovered Signal messages from criminal defendant Lynette Sharp's iPhone, despite her having deleted the application. The messages were reportedly extracted from the iPhone's push notification database. FBI Special Agent Clark Wiethorn explained that when a message arrives, the phone's operating system, not the Signal app itself, creates a preview. Even if Signal later deletes the message, the phone's system can retain a copy of this preview.

Law enforcement utilized Cellebrite, a forensic tool, to access these stored previews. Notably, only incoming messages were recovered, confirming the data originated from the notification storage, not the app's encrypted database. This method is not exclusive to Signal and could affect other messaging applications like WhatsApp and Telegram that display message previews.

Source: HackRead