TLDR: signal content in Apple notification can be retrieved even after signal app deletion.
I saw from this reddit thread: Signal messages retrieved from iPhone after uninstalling app. : signal
Referencing this news article: Pretti Killing May Affect ICE Prairieland “Antifa Cell” Terrorism Trial
The mention of signal is in court documents here: March 10: Federal Trial Day 12 - Support the Prairieland Defendants
Signal chat evidence from Sharp’s device (Exhibit 158):
Messages were recovered from Sharp’s phone through Apple’s internal notification storage — Signal had been removed, but incoming notifications were preserved in internal memory. Only incoming messages were captured (no outgoing).
It’s both. Governments have started subpoenaing the push notification servers for data, instead of targeting individual devices. That little pop-in that says who the message was from, and maybe a little bit of the body of the text? Yeah, the push notification server handled that, and the government has access to that server. So any notification you see on your screen, you can be pretty positive that the government has also seen.
But this is about the notification data being stored in a part of the phone that isn’t encrypted. Signal is (or at least claims to be) E2E encrypted, so it shouldn’t be possible for a warrant to get access to the messages in the app. But since the phone is storing those notifications in a separate area (which isn’t encrypted), the warrant was able to read them.
The point is that there are two different attack vectors, and you should harden your device against both.
This doesn’t make sense as the whole phone is encrypted. Do what magical unencrypted space is it stored. The push notification server yes that is an issue
if your whole phone is encrypted this likely doesn’t apply to you so long as you have a strong passpharse (6 characters or more) and a good data shredding policy (shred after 5 wrong guesses)
however, that is not most people