However, there was one small edge case: replying to the attachment.
After deleting the file, it was indeed purged from the %AppData% folder. īased on previous vulnerability research with Keybase, I then wondered if the image would properly get purged if I were to delete it. On this image in particular, you can see that the date is labeled as. This isn’t an edge case though, Signal is temporarily storing all of these attachments, unencrypted. png (on macOS and Linux you can see a preview of the native extensions so you don’t have to manually look at file properties) The image was stored as a regular file in this directory, and the image can be recovered by modifying the extension and adding. To replicate, an image was sent in a group chat C:\Users\foo\AppData\Roaming\Signal\attachments.noindex\*\ After looking through multiple files, the culprit directory was identified. While using signal, it was observed that the preview of an image was still visible even after having deleted the image because the image had been “replied” to.
0 kommentar(er)
