deleted secure chat in Telegramm

  • We encourage our users to use Real Names to build a real community, friendships and networking opportunities.

    [more information]

MByte-IT

New Member
Nov 16, 2018
1
1
#1
Hello,
is there a chance to recover a deleted secure chat from Telegramm?
I need this information for a lawer in a court process.
For a normal chat I can find it in the SQLite DB with Belkasoft, but for a secure chat too?
The secure chat is not stored on the Telegramm server, is that right?
The defandant has used an iPhone 7 and the other was an Android (don't know witch version)

Thank you very much,
Marcus
 

BIOS

New Member
Oct 30, 2018
4
Ratings
6
3
#2
Hi Marcus,

I don’t have experience dealing with Telegram so I can’t give a specific answer.

But I would say that until you confirm with testing & research, there is always a chance you might find the data you are looking for, including deleted “secure chats”.

Often the answer depends on a number of factors, including the model of phone / OS version, the App version, and time since deletion.

In regards to your question about “secure chat”, Telegram does have something called “Secret Chats” Telegram F.A.Q. which according to their FAQ, these appear to be stored directly on the devices and not on their servers.

You may want to look at a tool like Cellebrite as well. Their release notes for UFED PA Ver.7.10 show support for Telegram Ver. 4.9
https://cf-media.cellebrite.com/wp-content/uploads/2018/10/ReleaseNotes_UFEDPA_7.10.pdf

Hope that helps.
 

azuleonyx

Member
Experienced Member
Oct 20, 2018
33
Ratings
29
18
Charlotte, North Carolina Area
cyberfenixtech.blogspot.com
Twitter
https://twitter.com/AzuleOnyx
#3
Secure chat should be fully encrypted. However, there was an issue with the Windows Client which was not encrypting the chats properly. You can read a post by grugq on the subject of Telegram's encryption. There has been information leaks in the past from the Application. I would have to agree with @BIOS to perform your own testing on both iOS/Android, Windows, Mac, and Linux to see what is there. On the forensics side, I have not seen too much information on some of the major chat applications to see what artifacts can be located.
 

About us

  • Our community began in 2004. Since this time, we have grown to have over 29,000+ members within the DFIR & Cyber Security community.

    We are happy to announce that this forum is now under new ownership with the goal to once again become the main Digital Forensics Forum on the internet for DFIR, OSINT and Cyber Security.

    If you can think of ways to help us improve, please let us know.

    We pride ourselves on offering unbiased, critical discussion among people of all different backgrounds.

    We are working every day to make sure our community is one of the best.

Quick Navigation

User Menu