The Encryption Ghost: How the FBI Recovers “Deleted” Signal Messages from iPhone Caches

During a Texas federal proceeding in April 2026, the FBI presented deleted Signal messages recovered from an iOS notification cache as forensic evidence. The report explains that iOS lock-screen notification previews store decrypted message text in a system cache for about thirty days, allowing tools like Cellebrite to extract message fragments even after deletion or app removal; it recommends disabling lock-screen previews to prevent plaintext caching.