Repository logo
 
No Thumbnail Available
Publication

Decrypting messages: Extracting digital evidence from signal desktop for windows

Use this identifier to reference this record.

Advisor(s)

Abstract(s)

With growing concerns over the security and privacy of personal conversations, end-to-end encrypted instant messaging applications have become a key focus of forensic research. This study presents a detailed methodology along with an automated Python script for decrypting and analyzing forensic artifacts from Signal Desktop for Windows. The methodology is divided into two phases: i) decryption of locally stored data and ii) analysis and documentation of forensic artifacts. To ensure data integrity, the proposed approach enables retrieval without launching Signal Desktop, preventing potential alterations. Additionally, a reporting module organizes extracted data for forensic investigators, enhancing usability. Our approach is effective in extracting and analyzing encrypted Signal artifacts, providing a reliable method for forensic investigations.

Description

Article number - 301941

Keywords

Digital forensics Signal Windows Encryption Electron Instant messaging

Citation

Gonçalo Paulino, Miguel Negrão, Miguel Frade, Patrício Domingues, Decrypting messages: Extracting digital evidence from signal desktop for windows, Forensic Science International: Digital Investigation, Volume 54, 2025, 301941, ISSN 2666-2817, https://doi.org/10.1016/j.fsidi.2025.301941

Organizational Units

Journal Issue