Investigating iOS Telegram
01/09/2023 Friday
iOS Telegram is a widely used instant messaging application developed by Telegram Messenger LLP, catering exclusively to iOS devices. This app is known for its robust set of features that facilitate seamless communication. Users can send text messages, share photos, videos, documents, and engage in voice and video calls, both in one-on-one and group settings. What sets iOS Telegram apart is its strong emphasis on privacy and security, offering end-to-end encryption for messages, as well as the ability to send self-destructing messages. These features have contributed to its popularity and widespread use among users looking for a secure and versatile messaging platform.
Digital Forensics Value of iOS Telegram Artifacts
Telegram holds significant forensics value due to its messaging platform's features and security measures. The app's end-to-end encryption, self-destructing messages, and extensive multimedia sharing capabilities make it a valuable source for digital forensic investigations. It provides opportunities to analyze message content, user interactions, and potentially uncover critical evidence in various cases, from cybercrimes to legal inquiries, making it an asset for digital investigators.
Location of iOS Telegram Artifacts
iOS Telegram App artifacts can be found at the following locations:
\mobile\Containers\Shared\AppGroup\3CD0E034-8C49-4172-85DF-99D2C0BB08EE\telegram-data\account-***\postbox\db\db_sqlite
Analyzing iOS Telegram Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract iOS Telegram artifacts from iOS device files and what kind of digital forensics insights we can gain from the artifacts.
After you have created your case and added evidence for investigation, at the Artifacts Parser Selection Phase, you can select Telegram artifacts:
×
Once ArtiFast parser plugins complete processing artifacts for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of iOS Telegram artifacts in ArtiFast software.
iOS Telegram Messages Artifact
- Time: Date/Time message was sent.
- Sender Name: The name of the message sender.
- Message ID: The message ID.
- Thread ID: The thread key (ID).
- Forward Message Info: Information on forwarded messages.
- Sender Name: The message sender name.
- Sender ID: The message Sender ID.
- Recipient ID: The message receiver ID.
- Flags: Flags association with message.
- Message Text: Message content.
- Reference Media ID: IDs of referenced media.
- Embedded Media Info: Information on media with the message.
- Tags: Message tags.
iOS Telegram Users Artifact
- User name: The username.
- Phone Number: User’s phone number.
- User ID: The ID number of the user.
- Last Name: User’s last name.
- First Name: User’s first name.
- Title: User title.
For more information or suggestions please contact: ekrma.elnour@forensafe.com
