Apple patches a flaw that allowed recovery of deleted iPhone messages

Apple released a software update on Wednesday for iPhones and iPads addressing a security bug that could allow law enforcement or forensic tools to retrieve messages that had been deleted or set to disappear automatically in messaging apps. The issue occurred because message notifications displaying content were being cached on the device for up to one month.

In a security notice published on its website, Apple said the vulnerability meant that "notifications marked for deletion could be unexpectedly retained on the device."

The statement appears to directly reference an issue reported earlier this month by 404 Media. The independent publication reported that the FBI had extracted deleted Signal messages from an individual's iPhone using forensic tools. According to the report, the message content had been displayed in notifications and stored in a phone's database, even after the messages were deleted in Signal.

Following the report, Signal president Meredith Whittaker said the company had urged Apple to fix the issue. "Notifications for deleted messages shouldn't remain in any OS notification database," Whittaker wrote in a post on Bluesky.

It remains unclear why message notification content was being stored in this way. However, Apple's latest update suggests the behaviour was due to a software bug. Apple did not immediately respond to a request for comment regarding why notification data was being retained. The company also confirmed that it has backported the fix to devices running the older iOS 1m.

The issue raised concern among privacy advocates after it emerged that the FBI had been able to bypass protections used by messaging apps. Signal, like WhatsApp and other encrypted messaging services, includes a disappearing messages feature that automatically deletes messages after a set time period. The feature is widely used by individuals who want to reduce the risk of sensitive conversations being exposed if authorities access their devices.