Page 1

ENCRYPTEDAPPS & SECUREMESSENGERS · A GUIDE FOR UK LAWYERS iOS Encrypted Apps and Secure Messengers Signal, Telegram and Wickr: What Encryption Protects, What It Does Not, and What the Device Still Gives Up COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES SECURE-MESSENGER FORENSICS FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: encryption protects the wire, not the end point 03 What secure messengers protect, and how 04 What the device still holds 05 Where recovery genuinely stops 06 Understanding each app precisely 07 Deployment: recovering from the end point, honestly 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary The headline point: secure messengers like Signal, Telegram and Wickr protect messages in transit and against interception, not from the very device that displays them, so if a conversation is readable on the phone it is in principle recoverable from the phone, subject to each app's own on-device protections and deletion, which vary greatly.

§ 02 · FIRST PRINCIPLES The problem in plain English: encryption protects the wire, not the end point

§ 03 · WHATTHEYPROTECT What secure messengers protect, and how