var/mobile/Containers/Data/Application/UUID/Library/SplashBoard/Snapshots var/mobile/Containers/Shared/AppGroup/UUID/Attachments GRDBDatabaseCipherKeySpec for GRDBKe圜hainService var/mobile/Containers/Shared/AppGroup/UUID/grdb/signal.sqlite Users//Library/Application Support/Signal/sql/db.sqlite Users//Library/Application Support/Signal/config.json This file is encrypted using a key from the Android Keystore, which presents a challenge from a forensic perspective.Ĭ:/Users//AppData/Roaming/Signal/config.jsonĬ:/Users//AppData/Roaming/Signal/sql/db.sqlite Signal for Android stores its encrypted SQLCipher file at /data/data//databases/signal.db. In addition, attachments sent and received can be stored in /var/mobile/Containers/Shared/AppGroup//Attachments, and snapshots of Signal messaging screens, with visible text can be stored in /var/mobile/Containers/Data/Application//Library/SplashBoard/Snapshots.

The extracted encryption key, which is stored in the keychain in Base64 format, can be used to decrypt the database /var/mobile/Containers/Shared/AppGroup//grdb/signal.sqlite.

Signal for iOS stores its encryption key in the iOS keychain, which certain commercial tools can extract in its entirety. Another table of interest is the conversations table which contains the names of participants in the chat and the type of chat such as private, public, or group chat. This table contains message text, timestamp, whether it was ingoing or outgoing, and a column called json that contains a JSON representation of any file attachments contained in the message. The encryption key is stored in plaintext in a file named config.json, which can used with DB Browser for SQLCipher to decrypt the file and view the messages in the messages table (see Figure below). Decrypting the Signal “db.sqlite” SQLite database on Windows, macOS, and Linux is straightforward.

Signal private chat