John Z Black

John Z Black Apr 11, 2026 Privacy & Digital Rights #signal #ios #push-notifications #digital-forensics #fbi #privacy

Signal did everything right. The encryption held. Disappearing timers ran. Investigators still walked into federal court with Signal message content pulled from a seized iPhone.

Here’s how: when a message arrives and your screen is locked, iOS writes the preview text to a local notification database. Not Signal’s database. iOS’s. Signal can delete its messages, run disappearing timers, even be fully uninstalled. The iOS notification database doesn’t care. The preview text stays.

This was used in an actual federal prosecution. It’s not theoretical.

The fix is one setting. On iPhone: Settings, Notifications, find Signal, tap Show Previews, set to Never. iOS then shows “Signal: New Message” on your lock screen instead of the actual content, and nothing gets written to the database. Do the same for WhatsApp, Telegram, iMessage, or anything else you care about.

Signal isn’t broken. This is an iOS behavior on a physically seized device. The encryption is fine. You just need to know what iOS is quietly keeping underneath it.

Two minutes. Go do it.

The full explanation of what was recovered, how, and who should actually be worried about it