You may have spotted the recent case of the US Federal Bureau of Investigation pulling Signal messages from a defendant’s iPhone, even though the messages were set to disappear automatically, and the Signal app itself had been deleted from the phone.
The trick used by law enforcement? Previews of each incoming Signal message were logged in the notification database kept by iOS. Even though Signal had deleted the conversations, and Signal itself was deleted, this database was still available to the FBI’s forensics teams.
There is some good news: Apple has pushed out an iOS 26.4.2 update that makes sure notification logs are properly cleaned up after the notifications have expired. Make sure your iPhone is updated (via General > Software Update) and you should be protected against this type of intrusion.
Still, the events are concerning for anyone interested in protecting their own privacy. And even though Apple has improved iOS’s housekeeping, there are steps you can take to further minimize your risk in similar circumstances.
What Did the FBI Do?
Unsurprisingly, the FBI is reluctant to provide step-by-step instructions for how it breaks into smartphones and extracts data. Nevertheless, through reporting by 404 Media and analysis from experts such as cybersecurity specialist Andrea Fortuna, we can make some educated guesses about what happened.
What seems clear is that the forensics team didn’t break Signal’s encryption, or hack into any Signal database, but focused its attention on the database of notifications logged by iOS. It’s notable that the FBI could only extract incoming messages rather than outgoing ones, because messages being sent out from a device wouldn’t show up in a notification.
Given that Apple keeps iOS pretty tightly locked down, it seems likely that the analyzed iPhone was unlocked, or at least in an After First Unlock (AFU) state. When a phone reboots and first presents the lock screen, that’s a Before First Unlock (BFU) state—but when you subsequently lock and unlock your phone through the day, that’s AFU.
Even though an app’s messages may be gone, its notifications aren’t.Photograph: David Nield
Both states show the lock screen and keep your phone protected from unwelcome visitors, but BFU comes with some extra security and encryption measures. It’s one of the reasons Android phones now auto-reboot if they haven’t been used for three days—because that very first unlock screen after a restart is slightly more secure.
