Repository navigation
Off site Copy
04 · RUN AND PROTECT · All guides · Get help
Keep journal segments, preserved files, checkpoints and finished chat exports in S3-compatible storage. Each object is encrypted with AES-256-GCM before upload.
Open Exports → Off-site copy in the intended workspace. Prepare an existing bucket and storage credentials; TgWitness does not create the bucket.
| Field | Enter |
|---|---|
| Endpoint | Your storage service URL, without a bucket path or credentials |
| Region | The region required by that service |
| Bucket | An existing bucket you can access |
| Folder | The object prefix; TgWitness adds a workspace-specific prefix |
| Access keys | Both credentials together; leave both blank on later saves to retain them |
| Address style | Path-style or virtual-hosted addressing as required by the provider |
| Copy interval | The schedule while the application is running |
- Enter settings with Keep an off-site copy unchecked; select Save off-site copy.
- Select Test connection. This uploads an encrypted test object.
- Select Download encryption key and retain that file separately.
- Enable Keep an off-site copy, save again, and select Copy now for a first pass.
- Check the copied boundary, object count and any reported error.
The downloaded JSON contains the decryption key, destination settings, workspace prefix and signing-key fingerprint. Storage credentials are separate. Both the key file and credentials with read access are needed for recovery.
Download a fresh key file after changing the endpoint, bucket or prefix. Finished chat exports already removed from the local queue remain at their old destination.
Object Lock requires support and configuration in the bucket. Check the reported retention result; an accepted upload alone does not confirm retention.
Use a trusted TgWitness installation and an empty output directory for recovery. The complete S3 guide contains the commands and credential setup. Recovery checks journal consistency, checkpoints and preserved-media hashes before publishing restored material.
Uploads use Direct, SOCKS5 or HTTP. They are unavailable over MTProxy, and scheduled copies stop when the application stops. The demo displays the controls with uploads disabled.
An off-site evidence copy does not replace a complete service backup of account authorizations, private keys and configuration.
Continue: Service backup and recovery · Evidence reference
01 · Connect and capture
02 · Investigate and export
03 · Independent checks
04 · Run and protect
05 · Find an answer
Project and author