Page 1
ENCRYPTEDAPPS & SECUREMESSENGERS · A GUIDE FOR UK LAWYERS iOS Encrypted Apps and Secure Messengers Signal, Telegram and Wickr: What Encryption Protects, What It Does Not, and What the Device Still Gives Up COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES SECURE-MESSENGER FORENSICS FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: encryption protects the wire, not the end point 03 What secure messengers protect, and how 04 What the device still holds 05 Where recovery genuinely stops 06 Understanding each app precisely 07 Deployment: recovering from the end point, honestly 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary The headline point: secure messengers like Signal, Telegram and Wickr protect messages in transit and against interception, not from the very device that displays them, so if a conversation is readable on the phone it is in principle recoverable from the phone, subject to each app's own on-device protections and deletion, which vary greatly.
§ 02 · FIRST PRINCIPLES The problem in plain English: encryption protects the wire, not the end point
§ 03 · WHATTHEYPROTECT What secure messengers protect, and how
Page 2
§ 04 · WHAT THE DEVICE HOLD S What the device still holds
§ 05 · WHERERECOVERYSTOPS Where recovery genuinely stops
§ 06 · UNDERSTANDINGEACHAPP Understanding each app precisely
§ 07 · DEPLOYMENT Deployment: recovering from the end point, honestly
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE PROVIDER THE PHONE COUNTERPART BACKUPS / APFS CLOUD (END POINT) DEVICE ICLOUD SNAPSHOTS (SOME APP APPS)
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THE " UNRECOVERABLE " APPRECOVEREDFROMTHEENDPOINT EXAMPLE2 · THEDISAPPEARINGMESSAGESTHATWEREGENUINELYGONE EXAMPLE3 · THETHREEAPPSTHATBEHAVEDQUITEDIFFERENTLY
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORASECURE - MESSENGERANA LY SIS
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The secure-messenger checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Aren't apps like Signal simply unrecoverable? So can you always recover secure-messenger conversations? Do these apps all behave the same way? Can deleted secure-messenger messages be recovered? If we can't get it from the phone, is there another way? Does using a secure messenger look suspicious?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, IOS Encrypted Apps And Secure Messengers, Computer Forensics Lab, https://e-discovery.uk/library/ios-encrypted-apps-and-secure-messengers/pdf.