Signal

[antonioacsj]

I recently worked on a case with Signal Desktop for Windows and recovered messages as shown in the article: https://www.alexbilz.com/post/2021-06-07-forensic-artifacts-signal-desktop/
It's just a reading of a sqlite cipher and the key stays on the app folder. Just a suggestion to put in IPED.

[wladimirleite]

Hello @antonioacsj!
I think there is already an open issue for handling Signal databases (#1602).