Skip to content
PhishDestroy edited this page Oct 31, 2026 · 19 revisions
TgWitness — Work the case. Keep the record. An illustrated sequence follows a captured message, its edit and the retained record.

The investigation handbook

From your first capture to a verifiable handoff. Pick a path below, work with the record, and keep the checks alongside the conclusions.

Explore the demo · Start your first case · How the record works · Project

From a chat to a case.

Export a chat, follow leads across recorded chats and retain observed changes. Three illustrated workflows.

Illustrated workflows. Export a chat · Investigate · Capture changes

Your first investigation

  1. Set up — connect a dedicated account.
  2. Observe — choose your sources and capture scope.
  3. Investigate — trace the saved records across conversations.
  4. Hand over — export the record and verify it.

First successful check: a test message from a chat you control appears in the journal; its captured edit becomes another version; its deletion notice leaves the captured content available. Verify the signed export as well. This checks that sequence, not every possible Telegram event.

Pick your task

I want to… Open
Try TgWitness and connect an account Getting started → Accounts
Choose chats and keep observed changes Collection and coverage
Save one conversation for offline reading Export one chat
Investigate across conversations Investigations
Load history, search with AI or connect other tools Archive and integrations
Hand over and verify evidence Exports and verification
Retain an independent checkpoint Independent witness
Send alerts or keep an encrypted remote copy Notifications · Off-site copy
Run on a server and recover after a problem Server and Docker · Backup and recovery
Fix a problem or understand a term Troubleshooting · FAQ · Glossary
Workspace setup and advanced guides

Share an investigation: issue scoped access to chosen accounts and chats, with separate permissions, expiry and revocable sessions. Choose proxy routes and IP modes for collection and external requests.

Set up your workspace, work a case and keep the investigation running.

Get started and connect your account Investigation guide Server and Docker deployment

Connect & deploy Preserve & verify Find an answer
Proxies and connection routes Independent witness Troubleshooting
Servers and Docker Backup and recovery Frequently asked questions
Hardened deployment S3 off-site copy Glossary

Understand the evidence

Captured events link through SHA-256 hashes and carry Ed25519 signatures. Verify the record against a separately trusted key.

The evidence model and formulas · Interactive explanation

Read this before connecting

Ethical Notice & Historical Continuity Read the complete author statement: our statement on Taylor Wessing PartG mbB — German core, Hamburg office.

TgWitness is MIT-licensed. Our position on Taylor Wessing is a statement, not a licence condition.

Use a dedicated account you can afford to lose. A Telegram session grants access to that account; keep sessions, panel tokens and keys private. Local message content and attachments need disk encryption if you require protection at rest.

A signature establishes integrity relative to a trusted key. It does not prove that Telegram created a message, that collection was complete, or that an operator could not fabricate a journal.

Project and help

Project overview · Complete project guide · Technical documentation · Verification record · Get help · Contribute · Report a vulnerability

UI labels in this wiki follow the English interface. Labels may differ between releases.

Clone this wiki locally