Paulino, GonçaloNegrão, MiguelFrade, MiguelDomingues, Patrício2025-07-212025-07-212025-09Gonçalo Paulino, Miguel Negrão, Miguel Frade, Patrício Domingues, Decrypting messages: Extracting digital evidence from signal desktop for windows, Forensic Science International: Digital Investigation, Volume 54, 2025, 301941, ISSN 2666-2817, https://doi.org/10.1016/j.fsidi.2025.3019412666-2817http://hdl.handle.net/10400.8/13730Article number - 301941With growing concerns over the security and privacy of personal conversations, end-to-end encrypted instant messaging applications have become a key focus of forensic research. This study presents a detailed methodology along with an automated Python script for decrypting and analyzing forensic artifacts from Signal Desktop for Windows. The methodology is divided into two phases: i) decryption of locally stored data and ii) analysis and documentation of forensic artifacts. To ensure data integrity, the proposed approach enables retrieval without launching Signal Desktop, preventing potential alterations. Additionally, a reporting module organizes extracted data for forensic investigators, enhancing usability. Our approach is effective in extracting and analyzing encrypted Signal artifacts, providing a reliable method for forensic investigations.engDigital forensicsSignalWindowsEncryptionElectronInstant messagingjournal article10.1016/j.fsidi.2025.301941