Evidential scenario
Signal messages disappeared before the device was seized
The inquiry should document configured timers and identify related attachments, notifications, linked desktops and recipients, while accepting that expired content may not be recoverable.
Questions to resolve
Establish the fact base.
Q1
What timer was configured?
Q2
Was Signal Desktop linked?
Q3
Were attachments saved or forwarded?
Immediate actions
Preserve the available routes.
A1
Preserve every participating device available
A2
Capture current configuration and account state
A3
Examine linked desktops and saved media
A4
State recovery limitations expressly
Interpretation risks
Avoid premature conclusions.
Promising recovery inconsistent with Signal design
Inferring message content from timer settings
Destroying an unlocked state
Confidential case review
