Post by Dimitris P.

DELETED, BUT NOT ERASED: RECOVERING MESSAGES FROM NOTIFICATION LOGS The FBI was reportedly able to recover copies of incoming Signal messages from a suspect's iPhone even after the Signal application had been removed few months ago. This was achieved through forensic analysis of the device's push notification database, where portions of message content had been stored. As a result, even if the messaging application is deleted, residual artifacts containing portions of message content may remain on the device. Some digital forensic tools can identify and recover these artifacts during an examination, providing investigators with valuable evidence that may no longer be accessible through the application itself.