🤖 AI Summary
アメリカ連邦捜査局(FBI)は、被告のiPhoneからシークレットメッセージアプリ「Signal」の削除後のメッセージを FORESCOIENT 起源データと推測通知データから取り出すことができました。これは、アプリが削除された後でも、通知データベースにメッセージ内容が保存されるためです。
この事件ではテキサス州アルバリードでの炎放送や財産の破壊行為、そして警官への颈部射撃が関連していました。シークレットは画面ロック時にメッセージ通知を表示する設定にすると、iPhoneは内部メモリにこれらの通知を保存します。
FBI捜査官クリス・ウィーザーホーン氏は、取り得られた証拠について証言し、「シャープ」という協力者から送信されたメッセージが、Appleの推測データストレージを通じて復元されたと述べました。ただし出力されたメッセージのみが収集され、入力されたメッセージは含まれていませんでした。
この件では、シークレットアプリ内にメッセージコンテンツを通知画面に表示しない設定があるにもかかわらず、その機能を有効にしてしまうと危険であることが示されました。
An anonymous reader quotes a report from 404 Media: The FBI was able to forensically extract copies of incoming Signal messages from a defendant's iPhone, even after the app was deleted, because copies of the content were saved in the device's push notification database, multiple people present for FBI testimony in a recent trial told 404 Media. The case involved a group of people setting off fireworks and vandalizing property at the ICE Prairieland Detention Facility in Alvarado, Texas in July, and one shooting a police officer in the neck. The news shows how forensic extraction -- when someone has physical access to a device and is able to run specialized software on it -- can yield sensitive data derived from secure messaging apps in unexpected places. Signal already has a setting that blocks message content from displaying in push notifications; the case highlights why such a feature might be important for some users to turn on.
"We learned that specifically on iPhones, if one's settings in the Signal app allow for message notifications and previews to show up on the lock screen, [then] the iPhone will internally store those notifications/message previews in the internal memory of the device," a supporter of the defendants who was taking notes during the trial told 404 Media. [...] During one day of the related trial, FBI Special Agent Clark Wiethorn testified about some of the collected evidence. A summary of Exhibit 158 published on a group of supporters' website says, "Messages were recovered from Sharp's phone through Apple's internal notification storage -- Signal had been removed, but incoming notifications were preserved in internal memory. Only incoming messages were captured (no outgoing)."
404 Media spoke to one of the supporters who was taking notes during the trial, and to Harmony Schuerman, an attorney representing defendant Elizabeth Soto. Schuerman shared notes she took on Exhibit 158. "They were able to capture these chats bc [because] of the way she had notifications set up on her phone -- anytime a notification pops up on the lock screen, Apple stores it in the internal memory of the device," those notes read. The supporter added, "I was in the courtroom on the last day of the state's case when they had FBI Special Agent Clark testifying about some Signal messages. One set came from Lynette Sharp's phone (one of the cooperating witnesses), but the interesting detailed messages shown in court were messages that had been set to disappear and had in fact disappeared in the Signal app." Further reading: Apple Gave Governments Data On Thousands of Push Notifications
Read more of this story at Slashdot.