Feds Can Read Deleted Messages, Here’s How

A recent court case revealed that law enforcement can recover deleted messages from iPhones by extracting Apple's internal notification storage database. This works across all messaging apps, including Signal, even when disappearing messages are enabled and the app has been deleted. iOS stores incoming notification content — including message text and attachment previews — in a per-app folder at the OS level, independent of the app itself. Dismissed notifications appear to linger in this database for an unknown period of time, and Apple provides no documentation on when these files are cleared. The technique has been an open secret in digital forensics since at least 2019, but this court case marks the first confirmed public report of law enforcement actively using it. The only practical mitigation is configuring Signal (or other apps) to show no name or content in notifications, which significantly degrades the notification experience.