FBI Recovers Deleted Signal Messages Through iPhone Notification Database

The FBI successfully retrieved deleted Signal messages from a suspect's iPhone by tapping into a largely overlooked source of data: the device's notification database, according to newly surfaced court documents.

Rather than breaking Signal's end-to-end encryption, investigators exploited a feature of Apple's iOS notification system. When a message is received, a brief preview is often stored in the iPhone's notification database before a user can dismiss or delete it. That cached data persisted even after the messages themselves were deleted from within the Signal app.

The technique was revealed in documents related to a federal criminal case, highlighting a growing trend of law enforcement agencies finding creative workarounds to access encrypted communications without needing to crack the encryption itself.

Signal is widely regarded as one of the most secure messaging platforms available, and this discovery does not represent a flaw in Signal's own encryption. Instead, it underscores how the broader ecosystem of a smartphone — including notification logs, backups, and system databases — can become an unintended record of supposedly private conversations.

Security experts warn that users who rely on Signal for sensitive communications should review their iPhone notification settings. Disabling message previews in notifications is one practical step that could prevent content from being cached in this way.

The revelation serves as a reminder that true operational security requires attention not just to the apps being used, but to every layer of the device and operating system that supports them. Even the most secure messaging app can be undermined by default system behaviors that users rarely think to change.