Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
You may have spotted The last case Withdrawal of the US Federal Bureau of Investigation signal Letters from the accused iPhoneeven though the messages were set to disappear automatically, and the Signal app itself was deleted from the phone.
The trick used by law enforcement? Previews of every incoming Signal message are recorded in the notification database maintained by iOS. Although Signal deleted the conversations, and Signal itself was deleted, this database remained available to FBI forensic teams.
There’s some good news: Apple has pulled out iOS 26.4.2 update This ensures that notification logs are cleaned properly after notifications expire. Make sure your iPhone is updated (via General > Software update) and you must be protected against this type of intrusion.
However, the events are concerning for anyone concerned about protecting their privacy. Although Apple has improved iOS management, there are steps you can take to reduce your risk in similar circumstances.
What did the FBI do?
Unsurprisingly, the FBI is reluctant to provide step-by-step instructions on how to hack smartphones and extract data. However, by reporting via 404 media And analysis from experts such as a cybersecurity specialist Andrea FortunaWe can make some educated guesses about what happened.
What seems clear is that the forensics team did not break Signal’s encryption, or hack into any Signal database, but focused their attention on the notification database recorded by iOS. It is worth noting that the FBI can only extract incoming messages instead of outgoing messages, because messages sent from the device will not appear in the notification.
Since Apple keeps iOS tightly locked down, it seems likely that the iPhone analyzed was unlocked, or at least in an after-first-unlocked (AFU) state. When the phone reboots and shows the lock screen for the first time, that’s a pre-first unlock (BFU) state — but when you then lock and unlock your phone during the day, that’s an AFU state.
Although the app’s messages may disappear, its notifications do not.Photography: David Nield
Both offer a lock screen and keep your phone protected from unwelcome visitors, but BFU comes with some additional security and encryption measures. It is one of the reasons for Android phones Now auto restart If it has not been used for three days — because the first unlock screen after a reboot is somewhat more secure.
