Pro plugin

Signal Desktop

Collects messages, conversations, contacts, attachments, and security artifacts from Signal Desktop encrypted databases

messaging.signalPromacOS 10.15+v1.0.0communicationusermessagingsecurity

Run this plugin

Trigger collection for Signal Desktop on its own with the --plugin flag, or include it in a wider sweep by category.

# Just this plugin
macfor-pro collect --plugin messaging.signal --output ./evidence.zip

# Dry run — list what would be collected
macfor-pro collect --plugin messaging.signal --dry-run

Compatibility

macOS 10.15+

Licensing: ships in the macfor-pro binary. See Community vs Pro.

Artifacts (8 collected)

Each row corresponds to an entry in the plugin's artifacts.yaml manifest. Optionalartifacts are often absent, and their absence isn't recorded as an error. Plannedartifacts are documented locations the plugin doesn't collect yet. Where a path shows a version range, macfor only tries it when the source's macOS or application version is in that range.

messaging

Artifact	Format	Path	Notes
Signal Messages signal_messagesSensitivehigh value	sqlite	`~/Library/Application Support/Signal/sql/db.sqlite`	Plaintext messages from SQLCipher-encrypted database.
Signal Conversations signal_conversationsSensitivehigh value	sqlite	`~/Library/Application Support/Signal/sql/db.sqlite`	1:1 and group conversation metadata.

contacts

Artifact	Format	Path	Notes
Signal Contacts signal_contactsSensitivehigh value	sqlite	`~/Library/Application Support/Signal/sql/db.sqlite`	Contact identity keys and verification status.

media

Artifact	Format	Path	Notes
Signal Attachments signal_attachmentsSensitivemedium value	directory	`~/Library/Application Support/Signal/attachments.noindex/`	Media file metadata and opt-in file collection.
Signal Stickers signal_stickerslow value	directory	`~/Library/Application Support/Signal/stickers.noindex`	Sticker file metadata enumerated from the stickers directory (path and size only, no content).

credentials

Artifact	Format	Path	Notes
Signal Sessions signal_sessionsSensitivemedium value	sqlite	`~/Library/Application Support/Signal/sql/db.sqlite`	Signal protocol session state and key material (public only).

config

Artifact	Format	Path	Notes
Signal Application State signal_appstatemedium value	leveldb	`~/Library/Application Support/Signal/Local Storage/leveldb/`	Registration state, preferences, and application configuration.

metadata

Artifact	Format	Path	Notes
Signal Raw Files signal_rawOptionalOpt-in	binary	`~/Library/Application Support/Signal/`	Raw encrypted database and configuration files for offline analysis.