← All artifacts

Signal Desktop

Signal Desktop messaging artifacts — encrypted SQLCipher database, attachment cache, and configuration metadata.

Status
available
CLI plugin
messaging.signal
Categories
communication, user

Overview

Signal Desktop stores every conversation in a single SQLCipher-encrypted SQLite database. macfor reads the plaintext key field from config.json and uses it to decrypt the database. Newer Signal builds may keep the key in Keychain-wrapped safe storage instead. In that case macfor collects the encrypted database and config.json as-is for offline decryption.

Analysis Tips

  • Encryption key: Read from the key field in config.json. If no plaintext key is found, macfor falls back to raw file collection. macfor does not access the Keychain
  • Tables of interest: messages (per-message rows), conversations, contacts, sessions. JSON blobs in messages.json carry rich content metadata
  • Attachments: Files in attachments.noindex/ are individually encrypted — names are content-addressed hashes referenced from messages.json
  • Sync: Signal Desktop is paired to a phone — message history before pairing won't be present
  • Sticker packs and reactions: Recorded in the same database with distinct message types

Related Artifacts

  • WhatsApp Desktop - Comparable encrypted-messenger artifact for cross-platform investigations
  • TCC Database - Confirms Signal had file-system permissions to operate
  • Unified Logs - Application launch events for Signal

References

Data sources

db.sqliteSQLite (SQLCipher encrypted)

~/Library/Application Support/Signal/sql/

All Signal messages, conversations, contacts, and metadata. Encrypted with SQLCipher; macfor decrypts it with the key from config.json when present

config.jsonJSON

~/Library/Application Support/Signal/

Read to obtain the database key. macfor emits a sanitized record with a hash of the key, never the key itself

attachments.noindex/Binary (encrypted)

~/Library/Application Support/Signal/

Attachment files referenced by message records