Signal Timer Running on a Seized iPhone

Work from most volatile to least, and from clearly authorized to legally uncertain.

iPhone first. It is unlocked now and may not be later. Do not open Signal: opening the app can mark messages read and start the timer, and it changes the evidence. Place the phone in a Faraday bag or enable airplane mode to prevent remote wipe, keep it powered so it does not return to a locked-before-first-unlock state, and document the notification on screen by photograph before any interaction. Then perform a logical or full file-system extraction with a validated tool, capturing app container data including Signal's local database.

Laptop second. It is awake with BitLocker unlocked and a VPN session live, so encryption keys and session data exist only in memory. Capture volatile data - RAM, network connections, logged-in users, mounted volumes - before any shutdown. Then image the disk. Because the brother claims ownership, confirm the warrant or obtain consent before searching his data; a co-occupant's common authority may not extend to a computer he says is exclusively his.

External SSD third, write-blocked and hashed.

Samsung last. It is locked; keep it powered and isolated, identify the model and OS, and use the appropriate extraction method. Cloud comes after legal process, not before.

The phone is searchable only within the warrant's scope: records related to financial transactions. Signal is a messaging app, so its content may or may not fall inside that scope depending on what the conversation shows. The safer practice is to image the device fully and then search the extracted data against the warrant's terms, documenting which items were reviewed and which were segregated as outside scope. Consent from the suspect is an alternative if he is present and competent to give it, but consent must be voluntary and documented; a person under arrest in his own apartment can consent, but the record must show no coercion.

The cloud is a different question. The warrant says nothing about cloud storage, and a device warrant does not automatically reach accounts held by a third-party provider. Obtaining iCloud backups or Signal-linked account data requires separate legal process directed to the provider, typically a warrant under the Stored Communications Act, or valid consent from the account holder. Do not use credentials found on the phone to log in and pull cloud data - that is a scope question and can taint the evidence.

The brother's laptop claim is separate again: if he asserts exclusive ownership, get a warrant for that device or his written consent.

A 24-hour timer generally counts from the moment a message is read, not from when it was sent, though behavior differs by version and settings. If the messages have not been read, they may persist on the device as long as it stays offline or the app is not opened. If the recipient or the device user has read them, they may already be gone from the local database, though remnants can survive in notification caches, backups, and the SQLite write-ahead log.

Handling: do not open the app. Photograph the lock-screen notification as found. Keep the device isolated from the network so no new messages arrive and no remote deletion command executes. Then extract with a tool that acquires the Signal container, including its SQLite database and WAL file, and preserve the notification records from iOS itself.

If the messages are already deleted, look for secondary sources: iCloud device backups if enabled, the contact's own device, the notification database, and any linked desktop client. Document the timer setting as a fact in the report, because it affects what the absence of messages means - a gap is not proof that no conversation occurred. Chain of custody should record every access, including the initial observation, with timestamps and the examiner's identity.