Just gimme some kind of Signal: Collecting and analyzing Signal Messenger

With more than 70 million monthly active users, Signal Messenger is no longer a niche messaging app. Signal data may provide vital evidence in criminal, civil, regulatory, and investigatory matters. Yet Signal also presents challenges to digital forensic examiners both for collecting and analyzing the data. This talk will provide practical approaches to: 1. Collecting Signal data through full filesystem, including using Category Extractions to make targeted collections; 2. Determining whether a more accessible source of Signal data may exist if the user linked their Signal account on a computer; 3. Performing a remote collection of Signal Desktop data from a Mac or Windows computer, including collecting the necessary decryption keys. 4. Evaluating when you may need to analyze the Signal data outside of a forensic suite and how to decode notifications about changes to the disappearing message settings and other notifications that may show up as “no message content to display”.