iOS TeleGuard
15/08/2025 Friday
TeleGuard for iOS is a secure messaging app created by Swisscows,
designed with a strong emphasis on user privacy. It strictly follows
Swiss data protection regulations, ensuring the highest level of
security for user data. As a cross-platform application, TeleGuard
seamlessly integrates across devices. In addition to secure messaging,
it provides advanced features like IP telephony, enabling users to make
anonymous calls with high privacy.
Digital Forensics Values of iOS TeleGuard
The digital forensics value of data extracted from iOS TeleGuard
artifacts lies in the app's minimalist yet secure design. As outlined
below, investigators can obtain information such as users' messages,
posts, contacts, and channels. This extracted data offers valuable
insights into user behavior, communication patterns, and interactions
within the app. Such insights can help investigators trace communication
networks, identify potential relationships between users, and analyze
messaging activities.
Location of iOS TeleGuard Artifacts
iOS TeleGuard artifacts can be found at the following locations:
/private/var/mobile/Containers/Shared/AppGroup/<APP_GUID>/Library/teleguard_database.db
Analyzing iOS TeleGuard Artifact with ArtiFast
This section will discuss how to use ArtiFast to extract iOS TeleGuard
artifact from iOS machines’ files and what kind of digital forensics
insights we can gain from the artifact.
After you have created your case and added evidence for the
investigation, at the Artifact Selection phase, you can select iOS
TeleGuard artifact parsers:
×
Once ArtiFast parsers plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of iOS TeleGuard artifacts in ArtiFast.
iOS Teleguard Messages
- Date/Time: The timestamp when the message was created.
- User Time: The local timestamp when the message was created.
- Type: The type of message (TEXT, MEDIA, IMAGE, CALL, QUOTE, etc.).
- Sender: The sender of the message.
- Receiver: The receiver of the message.
- Content: The text content of the message.
- Status: The delivery status of the message (sent, delivered, read).
- Is Edited? Indicates whether the message has been edited.
- Call Successful? Indicates whether the call was successfully connected.
- Call Status: The status of the call (e.g., Missed, Canceled, Completed).
- Call Type: The type of call (e.g., AUDIO, VIDEO).
- Media File Name: The name of the media file sent in the message.
- Media Type: The type of media (e.g., IMAGE, VIDEO).
- Media Duration: The duration of the media file in seconds.
- Is Content Expired? Indicates whether the media content has expired.
- Quoted Text: The quoted message content.
- Quoted Author: The sender of the quoted message.
- Quoted Time: The timestamp of the quoted message.
- Quoted Message ID: The unique identifier of the quoted message.
- Quoted Message Type: The type of the quoted message (e.g., TEXT, IMAGE).
- Reply Type: The type of reply associated with the quoted message.
iOS Teleguard Posts
- Date/Time: The timestamp when the post was created.
- Channel ID: The unique identifier of the channel where the post was made.
- Header: The header or title of the post.
- Content: The content of the post.
- Type: The type of post (text, media, etc.).
- Local Status: The local status of the post (sent, failed, draft, etc.).
- Views Count: The number of views on the post.
- Likes Count: The number of likes received by the post.
- Dislikes Count: The number of dislikes received by the post.
- Metadata: Additional metadata about the post.
- Media: The media content associated with the post.
iOS Teleguard Contacts
- Last Activity Timestamp: The timestamp of the last activity of the contact.
- Server ID: The unique server ID assigned to the contact.
- Alias: The alias or display name of the contact.
- Type: The type of the contact (e.g., individual, group, bot).
- Color: The assigned color for the contact in the chat.
- Avatar: The avatar image of the contact, encoded in Base64 format.
- Key: The unique key for additional contact options.
- Mark: Mark status assigned to the contact.
- Custom Avatar: Indicates whether the contact has a custom avatar.
- Custom Alias: Indicates whether the contact has a custom alias.
- Messages Lifetime Duration: Duration for which messages are retained.
- Avatar ID: The ID of the avatar assigned to the contact.
- Admin: The admin of the group contact.
- Invites: List of invite codes associated with the contact.
- Moderators: List of moderators assigned to the group contact.
- Members: List of members in the group contact.
- Last Visit Time: The timestamp of the last visit of the contact.
- Personal ID: The personal identifier assigned to the contact.
iOS Teleguard Channels
- ID: The unique identifier of the channel in Teleguard.
- Alias: The alias or display name of the channel in Teleguard.
- Description: A short description of the channel.
- Category: The category of the channel (e.g., News, Entertainment, Sports).
- Color: The assigned color for the channel.
- Avatar ID: The identifier of the avatar image assigned to the channel.
- Subscribers Count: The number of users subscribed to the channel.
- Admin: The administrator(s) of the channel.
- Posts Count: The total number of posts in the channel.
- Is Deleted: Indicates whether the channel is deleted (1 = Yes, 0 = No).
- Language: The primary language used in the channel.
- Type: The type of the channel (e.g., Public, Private).
For more information or suggestions please contact: kalthoum.karkazan@forensafe.com
