Name: | Description: | Size: | Format: | |
---|---|---|---|---|
3.11 MB | Adobe PDF |
Advisor(s)
Abstract(s)
With growing concerns over the security and privacy of personal conversations, end-to-end encrypted instant messaging applications have become a key focus of forensic research. This study presents a detailed methodology along with an automated Python script for decrypting and analyzing forensic artifacts from Signal Desktop for Windows. The methodology is divided into two phases: i) decryption of locally stored data and ii) analysis and documentation of forensic artifacts. To ensure data integrity, the proposed approach enables retrieval without launching Signal Desktop, preventing potential alterations. Additionally, a reporting module organizes extracted data for forensic investigators, enhancing usability. Our approach is effective in extracting and analyzing encrypted Signal artifacts, providing a reliable method for forensic investigations.
Description
Article number - 301941
Keywords
Digital forensics Signal Windows Encryption Electron Instant messaging
Citation
Gonçalo Paulino, Miguel Negrão, Miguel Frade, Patrício Domingues, Decrypting messages: Extracting digital evidence from signal desktop for windows, Forensic Science International: Digital Investigation, Volume 54, 2025, 301941, ISSN 2666-2817, https://doi.org/10.1016/j.fsidi.2025.301941
Publisher
Elsevier