Available conversations
Accessible messages, groups, reactions, replies, edits and related account records examined within the limits of the device state.
Encrypted messaging evidence
Signal
Forensics.
Evidence-led assessment of Signal data, device artefacts, linked desktops and communications, with clear treatment of encryption and disappearing-message limitations.
Discuss a deviceExamination
What we can
establish.
Every instruction begins with the questions to be answered. Available evidence depends on the device, software, state, credentials, backups and prior handling.
Attachments & calls
Available media, documents, voice notes and call artefacts correlated with conversations, timestamps and the wider file system.
Disappearing messages
Timer settings, residual traces and related system evidence assessed without overstating what can be recovered after content expires.
Sealed sender & identity
Profiles, safety-number changes, registration information and surrounding artefacts considered while respecting the limits of what they prove.
Linked desktop evidence
Authorised Signal Desktop installations and associated local artefacts considered as a separate evidential source where available.
Backup mechanisms
Distinguish Signal Secure Backups, on-device backup files and device-to-device transfer. Confirm the installed build, platform, archive format, prior enablement, retained files and required recovery material. Published platform descriptions can differ, so verify the actual mechanism before relying on it. A consumer restore feature is not proof of a validated forensic acquisition route, and excluded or expired content cannot be promised.
Corroboration
Notifications, media, linked devices, recipient evidence and other device records tested where they can support or challenge an account.
Evidence source map
Beyond the
visible application.
Absence from one screen or device does not resolve the evidential question. Relevant records may be distributed across several sources.
Local records
Accessible encrypted message records, attachments, settings and account events.
Backup and account
Optional end-to-end encrypted Secure Backups require the relevant recovery key and prior enablement. Assess exact version and collection feasibility.
Existing linked endpoints
Existing desktop databases may provide independent evidence; they are not automatically a phone-restoration source.
Limits and corroboration
Ordinary iCloud/Google device backups must not be assumed to include chats. Backup availability does not guarantee forensic acquisition or expired-message recovery. Lawfully obtained counterpart records may corroborate the source.
Evidential perspective
Strong privacy controls create evidential boundaries.
Signal is intentionally designed to minimise retained information. A sound examination distinguishes recoverable evidence from inference, documents the effect of disappearing messages and avoids claims the underlying artefacts cannot support.
Preserve now
Protect the
best evidence.
- 01Do not reset, update, reinstall or casually browse the application.
- 02Record the device, lock, power and network state.
- 03Identify backups, linked computers and counterpart devices promptly.
- 04Secure known credentials separately and maintain custody records.
Typical deliverables
Acquisition record
Device details, condition, method, tool, integrity information and material acquisition limitations.
Evidence schedule
Relevant conversations, attachments, timestamps, identifiers and supporting artefacts in a reviewable form.
Findings report
Plain-English findings with source references, alternative explanations and express evidential limitations.
Our approach
Proportionate.
Documented.
Explainable.
- 01Authority, objectives and device state confirmed.
- 02Acquisition method selected to preserve the best available evidence.
- 03Findings correlated and tested against alternative explanations.
- 04Clear reporting of methodology, findings and limitations.
Sources and interpretation
Each entry identifies its limited supporting proposition and documentation-check date. General methodology is not a current device-support list. These checks are not laboratory validation; availability and method suitability require assessment for the exact source and configuration.
- Signal Secure Backups
Optional encrypted backups; restoration support is not proof of forensic acquisition support.
Platform documentation · Documentation checked
- NIST mobile device forensics guidance
Methodological background (2014), not a current device-support list.
General methodology · Documentation checked
- Signal Support: Signal PIN
The PIN is not a chat backup or backup recovery key.
Technical documentation · Documentation checked
- Signal Support: Backups and Device Transfers
At review, describes on-device backups for Android, iOS and Desktop; conflicts with Signal’s Troubleshooting Signal Secure Backups page.
Technical documentation · Documentation checked
- Signal Support: Troubleshooting Signal Secure Backups
At review, still describes on-device backups as Android-only. Confirm exact build and format.
Technical documentation · Documentation checked
Confidential case review
