FAQ

Frequently asked questions

05 · FIND AN ANSWER · All guides · Get help

On this page

• Does TgWitness recover messages deleted before it started?
• What does archive verification check?
• Is every Telegram event guaranteed to arrive?
• Can I use a bot token instead of a user account?
• Do I need my own API ID and API hash?
• Can several people have separate access permissions?
• Are messages and attachments encrypted on disk?
• Does Lock stop collection?
• Why can two accounts show different histories?
• Does a public proxy failure switch me to a direct connection?
• Are an evidence export and a backup interchangeable?
• Is a witness on my server independent?
• Is Linux, macOS or Docker support already fully qualified?
• How do I report a problem or contribute?

Does TgWitness recover messages deleted before it started?

No. You might see a deletion with no content behind it. Loading history only gets what the account can see right now, not old versions.

What does archive verification check?

Record signatures, the journal chain, the file manifest and attachment hashes. Give it a key fingerprint and checkpoint kept elsewhere and it also checks the expected key and an earlier journal state. An independent witness adds more checkpoints, and GitHub Actions capture also checks the archive's provenance against the approved workflow and collector version.

Verification steps · Technical trust model

Is every Telegram event guaranteed to arrive?

No. Permissions, network drops, Telegram itself and restarts all get in the way. Rechecks help, but look at the coverage report.

Can I use a bot token instead of a user account?

No, the collector needs a user account. Bot tokens are only for the optional witness.

Do I need my own API ID and API hash?

No. The built-in pool works fine, saved or imported credentials are reused. An API pair only identifies the app, it gives no access to anyone's account.

Can several people have separate access permissions?

Yes. Create a token under Access, pick workspaces, chats and permissions, add limits if you want. The main panel token stays unrestricted. See access and permissions.

Are messages and attachments encrypted on disk?

Sessions, credentials and keys are, in the vault. The journal and files aren't, so use disk encryption. Exports can get a password.

Does Lock stop collection?

No, it only closes the browser panel. Pause observation stops collecting. Closing the tab doesn't stop anything either.

Why can two accounts show different histories?

Different access, join dates, visibility. Each workspace keeps its own observations and key, so always say which workspace a record came from.

Does a public proxy failure switch me to a direct connection?

Not with Hide the address. Direct as a last resort goes direct after a delay, Server behind a tunnel or VPN allows direct. Outside requests and the witness have their own rules. See connection routes.

Are an evidence export and a backup interchangeable?

No. An export leaves out login and signing secrets on purpose. A backup is the whole stopped data directory plus any external vault key.

Is a witness on my server independent?

Not really. It has its own process and key, but you still control the server. Real independence means someone else runs it.

Is Linux, macOS or Docker support already fully qualified?

Check the verification record. Having a launcher or a CI job isn't the same as having tested every platform live.

How do I report a problem or contribute?

Support for help and bugs, Contributing for code, Security for vulnerabilities.