🤖 AI Summary
この記事は、FBIが被告のiPhone内の削除されたSignalメッセージを FORESCO 構造を使用して抽出した事件について述べています。主なポイントは以下の通りです:
1. **事案概要**:被告グループがテキサス州アルバリーロード ICE プライアリランド収容所で fireworks や財産損壊、警察官への射撃を起こした事件に関連しています。
2. **削除されたメッセージの抽出方法**:Signalアプリが削除されても、iPhoneのプッシュ通知データベースに保存されているため、FBIはこれらのメッセージを FORESCO 構造を使用して抽出することができました。これは信号伝送の設定により、ロック画面に表示される通知とプレビューが内部メモリに保存されることから可能でした。
3. **証拠の詳細**:特別代理人的 witness Clark Wiethorn の証言によると、被告 Lynette Sharp の携帯電話からメッセージが抽出され、その中には削除設定された詳細な会話も含まれていました。
4. **重要性**:この件は、Signalアプリで通知とプレビュー表示を無効にすることでプライバシー保護が可能であることを示しています。これはユーザーにとって重要な設定項目となっています。
5. **追加情報**:Appleは政府機関に対して数千のプッシュ通知データを提供していたことがさらに報告されています。
この件は、デバイスへの物理的アクセスと専門的なソフトウェアを使用した Forensic Extraction の重要性を示しています。
An anonymous reader quotes a report from 404 Media: The FBI was able to forensically extract copies of incoming Signal messages from a defendant's iPhone, even after the app was deleted, because copies of the content were saved in the device's push notification database, multiple people present for FBI testimony in a recent trial told 404 Media. The case involved a group of people setting off fireworks and vandalizing property at the ICE Prairieland Detention Facility in Alvarado, Texas in July, and one shooting a police officer in the neck. The news shows how forensic extraction -- when someone has physical access to a device and is able to run specialized software on it -- can yield sensitive data derived from secure messaging apps in unexpected places. Signal already has a setting that blocks message content from displaying in push notifications; the case highlights why such a feature might be important for some users to turn on.
"We learned that specifically on iPhones, if one's settings in the Signal app allow for message notifications and previews to show up on the lock screen, [then] the iPhone will internally store those notifications/message previews in the internal memory of the device," a supporter of the defendants who was taking notes during the trial told 404 Media. [...] During one day of the related trial, FBI Special Agent Clark Wiethorn testified about some of the collected evidence. A summary of Exhibit 158 published on a group of supporters' website says, "Messages were recovered from Sharp's phone through Apple's internal notification storage -- Signal had been removed, but incoming notifications were preserved in internal memory. Only incoming messages were captured (no outgoing)."
404 Media spoke to one of the supporters who was taking notes during the trial, and to Harmony Schuerman, an attorney representing defendant Elizabeth Soto. Schuerman shared notes she took on Exhibit 158. "They were able to capture these chats bc [because] of the way she had notifications set up on her phone -- anytime a notification pops up on the lock screen, Apple stores it in the internal memory of the device," those notes read. The supporter added, "I was in the courtroom on the last day of the state's case when they had FBI Special Agent Clark testifying about some Signal messages. One set came from Lynette Sharp's phone (one of the cooperating witnesses), but the interesting detailed messages shown in court were messages that had been set to disappear and had in fact disappeared in the Signal app." Further reading: Apple Gave Governments Data On Thousands of Push Notifications
Read more of this story at Slashdot.