MOBILE FORENSICS

Conducting a forensic analysis of Signal Messenger on Android

Signal is one of the security-focused messaging apps and relies on consistent end-to-end encryption. For Android forensics, this gives rise to specific technical requirements when it comes to backing up and analysing existing artefacts.

SQLite databases
Encrypted application data
Media and attachments
Profile information
Timestamps and metadata
Configuration files
Journal and WAL files
Device and account information

TECHNICAL BACKGROUND

Technical Fundamentals

Signal stores app data in several internal areas of the Android file system.

Forensically relevant artefacts include, amongst others:

  • •SQLite databases
  • •Encrypted application data
  • •Media and attachments
  • •Profile information
  • •Timestamps and metadata
  • •Configuration files
  • •Journal and WAL files
  • •Device and account information

The layout and storage locations may vary depending on the signal version and Android version.

OUR APPROACH

This is how your examination will be carried out

A transparent process – from the initial enquiry to the handover of the report.

1
Following a suitable forensic data backup, Signal databases, metadata, media and other artefacts are analysed using recognised IT forensic tools and manual analysis. The results are documented in a reproducible manner and assessed solely on the basis of objective technical findings.
2
LanCologne produces expert reports for private individuals, as well as for companies and solicitors. Our reports have already been used in court proceedings. In some cases, we have been directly commissioned to produce IT forensic reports. Upon request, we can provide anonymised or redacted sample reports or extracts.

TYPICAL QUESTIONS

When is this analysis required?

  • ✔What news and media are available?
  • ✔Which databases can be analysed?
  • ✔What are the implications of encryption?
  • ✔Is it technically possible to recover deleted content?
  • ✔How significant are the available artefacts?

LIMITATIONS & CONCLUSION

What you should know

Signal’s security mechanisms may limit the scope of a forensic analysis. End-to-end encryption, deleted data or the absence of backups may mean that certain information is no longer technically accessible.

Despite its high security standards, Signal does provide artefacts relevant to forensic analysis. However, their significance can only be determined through a combined assessment of all available technical data sources.

CUSTOMER REVIEWS

What our customers say

4.8 out of 5 stars on Trustpilot · 54 reviews

★★★★★

“The highest standards of professionalism, prompt service and excellent communication. They made the seemingly impossible a reality. This is what genuine customer service is all about – unrivalled in Germany!”

idalein

Verified review on Trustpilot

★★★★★

“Very helpful advice, excellent responsiveness and communication. My problem was completely resolved and the lost data was recovered. I’m very satisfied and, of course, relieved!”

Layla Pankratz

Verified review on Trustpilot

★★★★★

“My problem was sorted out professionally and quickly; everyone I spoke to was always friendly, and I can still get in touch if I have any questions – I’m very grateful for that!”

a woman from Cologne

Verified review on Trustpilot

Enquire now – free initial consultation

Would you like to have signal data professionally analysed on an Android device? LanCologne can assist you with an objective IT forensic analysis and comprehensive expert documentation.

RELATED TOPICS

You might also be interested in

FREQUENTLY ASKED QUESTIONS

Frequently Asked Questions

Click on a question to see the answer.

Is Signal end-to-end encrypted?
Yes. Messages are end-to-end encrypted by default.
Is data stored locally?
Yes. Depending on the app version, different local artefacts are stored.
Can deleted messages be recovered?
That depends on the data set and the artefacts available.
Are media outlets also being investigated?
Yes. Images, videos and other attachments can form part of an analysis.
Could an expert report be drawn up on this matter?
Yes. The results are documented in a transparent manner and assessed from a technical perspective.