FBI used iPhone notification data to retrieve deleted Signal messages

Post by i_am_proteus » Fri, Apr 10, 2026, 12:07 PM UTC

Post by preinheimer » Fri, Apr 10, 2026, 12:15 PM UTC

lenerdenator wrote: post #10

There needs to be a bit more "group chat" control in Signal messages, wherein you could enforce certain settings for certain chats regardless of the phone settings. You could have group chats that would enforce not showing more information in the notifications, while others would still allow it.

Post by kome » Fri, Apr 10, 2026, 12:21 PM UTC

preinheimer wrote: post #13

lenerdenator wrote: post #10

There needs to be a bit more "group chat" control in Signal messages, wherein you could enforce certain settings for certain chats regardless of the phone settings. You could have group chats that would enforce not showing more information in the notifications, while others would still allow it.

This feels like it would run against the “I bought my device, I should control how it behaves” line of thinking.

Post by kome » Fri, Apr 10, 2026, 12:22 PM UTC

Post by alin23 » Fri, Apr 10, 2026, 12:27 PM UTC

chasil wrote: post #7

First, a critical setting for Signal users: "Signal’s settings include an option that prevents the actual message content from being previewed in notifications. However, it appears the defendant did not have that setting enabled, which, in turn, seemingly allowed the system to store the content in the database." Second, how can I see this notification history?

      HOURS=6
      EPOCH_DIFF=978307200
      SINCE=$(echo "$(date +%s) - $EPOCH_DIFF - $HOURS * 3600" | bc)

      sqlite3 ~/Library/Group\ Containers/group.com.apple.usernoted/db2/db \
        "SELECT r.delivered_date, COALESCE(a.identifier, 'unknown'), hex(r.data)
        FROM record r
        LEFT JOIN app a ON r.app_id = a.app_id
        WHERE r.delivered_date > $SINCE
        ORDER BY r.delivered_date ASC;" \
      | while IFS='|' read -r cfdate bundle hexdata; do
          date -r $(echo "$cfdate + $EPOCH_DIFF" | bc | cut -d. -f1) '+%Y-%m-%d %H:%M:%S'
          echo "  app: $bundle"
          echo "$hexdata" | xxd -r -p > /tmp/notif.plist
          plutil -p /tmp/notif.plist 2>/dev/null \
            | grep -E '"(titl|title|subt|subtitle|body|message)"' \
            | sed 's/^  */  /'
          echo "---"
      done