Please Follow us on Truth Social, X , Youtube , Minds, Telegram, Rumble, GETTR, Gab
Federal investigators were able to extract copies of incoming Signal messages from a suspect’s iPhone even after the encrypted messaging app had been deleted, according to testimony in a high-profile criminal trial tied to an attack on a Texas immigration detention facility.
The revelation emerged during proceedings related to the July 2025 assault on the Prairieland ICE Detention Facility in Alvarado, Texas. Prosecutors alleged that a group used fireworks to damage property and that one individual shot an Alvarado police officer in the neck during the incident. The case, which involved multiple defendants charged with terrorism-related offenses, concluded with guilty verdicts on numerous counts.
FBI Special Agent Clark Wiethorn testified that forensic analysis of a seized iPhone belonging to defendant Lynette Sharp recovered remnants of Signal communications. Sharp had previously pleaded guilty to providing material support to terrorists. Court notes and accounts from trial attendees, including defense attorney Harmony Schuerman, indicated that the messages were pulled from Apple’s internal notification storage—even though the Signal app had been uninstalled and some messages were set to disappear.
Only incoming messages were recoverable through this method; outgoing messages were not captured.According to experts and courtroom summaries, the data persisted because Signal’s notification previews—when enabled—display sender information and message content on the lock screen. Apple’s iOS stores these previews in its notification database, where they can remain even after the app is deleted. Apple has not publicly specified how long such data is retained.
The vulnerability is not unique to Signal. Similar notification storage on iPhones can affect other messaging apps that show content in push notifications. Signal offers users controls to limit what appears in notifications, including options to hide message content or sender details entirely.Privacy and digital forensics experts recommend disabling or minimizing notification previews on the lock screen to reduce exposure. Most messaging apps provide comparable privacy settings that prevent full message text from appearing in notifications.The Prairieland case marked one of the first prosecutions involving alleged Antifa-linked activities following the designation of the movement as a domestic terrorist organization. All defendants in the recent trial were convicted on multiple charges.
The incident highlights ongoing challenges in digital privacy, even with end-to-end encrypted apps, when device-level data such as notifications can be forensically recovered from physical access to a phone.
