Evidence report · Signed

Harbor portal · Fictional investigation

Case IDHBR-042

Created2026-11-01 15:53:13 UTC

Report ID3f5094c1

Checking…

37Records

3Chats

18Messages

3Edits

3Deletions

0Files

0Timestamps

0 minObserved

1Case

Case title	Harbor portal · Fictional investigation
Case ID	HBR-042
Report language	en
Report ID	`3f5094c1-8c5a-4cd5-b2a0-798d2b52846c`
Created	2026-11-01 15:53:13 UTC
Produced by	TgWitness 0.7.0 · PhishDestroy

Notes

Synthetic demonstration. No Telegram connection. All people, domains and messages in this case are fictional.

2Integrity

Every record is linked to the previous one by SHA-256 and signed with Ed25519 when it is captured. The manifest lists the SHA-256 of every file and is signed with the same key.

Signing key fingerprint (SHA-256)

eca5654f58bffbbeed443ff65f4c903b8660c1d2a02f0b94d6e6c33bddcd3ea2

Compare this fingerprint with a copy kept apart from the collector, for example one published or given to the recipient beforehand.

Chain start0000…0000

#12574b78f…02d5

Records in between: 35SHA-256 · Ed25519

#37 · Head0e9ec56c…0be7

Records	37
Head hash	`0e9ec56c7962ac6f22495c4485cfd8b80758b8dace0f2ee2b8dae4d6bf3c0be7`
Hash algorithm	SHA-256 (FIPS 180-4)
Signature algorithm	Ed25519 (RFC 8032)
Public key	`JZffQIo/Zf7+JbiSSocJ9i3eO5ntxhp/aDpVZ+3onfg=`
events.jsonl SHA-256	`8ae0d24e7beebd97774acb96ede24edb3e778f0c6b11da0104438a2eb17ebfde`

3Timestamps

A timestamp shows that a checkpoint, and every record before it, existed no later than the stamped time. Records after the latest stamped checkpoint rely on the collector's clock.

No independent timestamps in this export: times come from the collector's clock. Turn on Evidence mode to stamp checkpoints automatically.

4Coverage

Continuous means observation was on, connected and writing records at least every three minutes. IDs not observed were never seen by this collector; that is not evidence that they were deleted.

Continuous observation

—

Verifier summary

As verify.py prints it, in English.

No observation period recorded.

1 chat-level coverage note(s), listed as coverage events below.

5Chain of custody

How this material was acquired, preserved and handed over. custody.json carries the same record for case-management systems.

Observed and recorded2026-11-01 15:53:02 UTC — 2026-11-01 15:53:02 UTC
Each record hashed and signed at captureRecords: 37
Checkpoints timestampednone in this export
Journal verified and exported2026-11-01 15:53:13 UTC
Report sealed2026-11-01 15:53:13 UTC ·

Acquisition tool	TgWitness 0.7.0
Acquisition method	Telegram client observing the account; records chained by SHA-256 and signed with Ed25519 as they are written.
Export host	Windows 11 · Python 3.12.10
Time standard	UTC · ISO 8601

Custody transfers

Fill in by hand when the printed report or the archive changes hands.

Date and time

Released by

Received by

Purpose

Signature

6How to verify

Anyone can repeat these checks. They show whether the material changed after it was signed.

Get the signer's key fingerprint from a trusted channel, not from this archive.

Check the whole archive: signatures, hashes, record chain and this report's seal.

python verify.py tgwitness-evidence.zip --fingerprint eca5654f58bffbbeed443ff65f4c903b8660c1d2a02f0b94d6e6c33bddcd3ea2

Without Python, check the file hashes (not the signature):

sha256sum -c SHA256SUMS

shasum -a 256 -c SHA256SUMS

Get-FileHash -Algorithm SHA256 events.jsonl

This report on its own:

python verify.py report.html --fingerprint eca5654f58bffbbeed443ff65f4c903b8660c1d2a02f0b94d6e6c33bddcd3ea2 --evidence tgwitness-evidence.zip

7Files in this archive

manifest.json lists the SHA-256 of every file and is signed in manifest.sig.

File Purpose SHA-256

coverage.json Observation periods, gaps and message IDs never observed 83c57529b86c0021…e73c12c3

custody.json Chain of custody and acquisition details 541b4bdc1738bb0a…2f7385ec

events.csv The same records for spreadsheets (formula-safe) e909ba9b0b5ab50b…d9e97842

events.jsonl Authoritative journal: one signed record per line 8ae0d24e7beebd97…b17ebfde

verify.py Standalone verifier (Python 3.11+, cryptography) 23ef9a1bd9c4a5cb…9c49aa8e

report.html This readable report, sealed listed in manifest.json

README.txt Instructions in the report language and in English listed in manifest.json

SHA256SUMS SHA-256 of every file, for sha256sum -c listed in manifest.json

manifest.json Signed list of every file with its SHA-256 listed in manifest.json

manifest.sig Ed25519 signature of manifest.json listed in manifest.json

File	Purpose	SHA-256
`coverage.json`	Observation periods, gaps and message IDs never observed	`83c57529b86c0021…e73c12c3`
`custody.json`	Chain of custody and acquisition details	`541b4bdc1738bb0a…2f7385ec`
`events.csv`	The same records for spreadsheets (formula-safe)	`e909ba9b0b5ab50b…d9e97842`
`events.jsonl`	Authoritative journal: one signed record per line	`8ae0d24e7beebd97…b17ebfde`
`verify.py`	Standalone verifier (Python 3.11+, cryptography)	`23ef9a1bd9c4a5cb…9c49aa8e`
`report.html`	This readable report, sealed	listed in manifest.json
`README.txt`	Instructions in the report language and in English	listed in manifest.json
`SHA256SUMS`	SHA-256 of every file, for sha256sum -c	listed in manifest.json
`manifest.json`	Signed list of every file with its SHA-256	listed in manifest.json
`manifest.sig`	Ed25519 signature of manifest.json	listed in manifest.json

8Standards and methodology

This export follows these practices. Alignment, not certification.

Reference	How it is applied
ISO/IEC 27037:2012 Identification, collection, acquisition and preservation of digital evidence	Capture time, tool, method and account are recorded; every record is hashed and signed when it is captured.
ISO/IEC 27042:2015 Analysis and interpretation of digital evidence	Authoritative files and readable derivatives are kept apart; limitations are stated with the results.
NIST SP 800-86 Integrating forensic techniques into incident response	Collection, examination, analysis and reporting are separate, documented steps.
Berkeley Protocol (OHCHR, 2022) Digital open source investigations	Source identifiers, capture times, collector and hash values are preserved with each item.
RFC 3161 Time-Stamp Protocol	In Evidence mode, journal checkpoints are stamped by independent timestamp authorities.
eIDAS, Art. 41 Qualified electronic time stamps (EU)	Choose a qualified timestamp authority where a legal presumption of accuracy is needed.
RFC 8032 · FIPS 180-4 Ed25519 signatures · SHA-256 hashes	Records and the manifest are signed with Ed25519; files and records are identified by SHA-256.
ISO 8601 · RFC 3339 Date and time format	All times are written in UTC with an explicit offset.
ISO 15836 (Dublin Core) · schema.org Document metadata	Reports carry machine-readable metadata for case-management and archiving systems.

Reference

How it is applied

ISO/IEC 27037:2012
Identification, collection, acquisition and preservation of digital evidence

Capture time, tool, method and account are recorded; every record is hashed and signed when it is captured.

ISO/IEC 27042:2015
Analysis and interpretation of digital evidence

Authoritative files and readable derivatives are kept apart; limitations are stated with the results.

NIST SP 800-86
Integrating forensic techniques into incident response

Collection, examination, analysis and reporting are separate, documented steps.

Berkeley Protocol (OHCHR, 2022)
Digital open source investigations

Source identifiers, capture times, collector and hash values are preserved with each item.

RFC 3161
Time-Stamp Protocol

In Evidence mode, journal checkpoints are stamped by independent timestamp authorities.

eIDAS, Art. 41
Qualified electronic time stamps (EU)

Choose a qualified timestamp authority where a legal presumption of accuracy is needed.

RFC 8032 · FIPS 180-4
Ed25519 signatures · SHA-256 hashes

Records and the manifest are signed with Ed25519; files and records are identified by SHA-256.

ISO 8601 · RFC 3339
Date and time format

All times are written in UTC with an explicit offset.

ISO 15836 (Dublin Core) · schema.org
Document metadata

Reports carry machine-readable metadata for case-management and archiving systems.

9Limitations

Read these before relying on the material.

This journal records observations made by a Telegram client, not Telegram-signed evidence.
Observed time uses the collector's system clock; it is not a trusted timestamp.
Messages deleted before collection and unobserved intermediate edits cannot be recovered.
Deletion actors are generally unavailable. Unscoped deletions are not attributed to a chat.
Reaction identities and membership changes are partial and depend on Telegram visibility.
Backfill is a current history snapshot, not reconstruction of missed events.
Signatures detect changes relative to a trusted key. Retain the fingerprint and checkpoints elsewhere.

10Records

Every record of the journal in order. Filters only change what is shown.

Shown: 37

#1demo.created2026-11-01 15:53:02 UTC

Record data

{
  "meaning": "Fictional demonstration; no Telegram connection",
  "synthetic": true
}

#2New messageNorthstar · Research · message 4012026-11-01 15:53:02 UTC

Morgan Reed · id 70001

Case HBR-042. Keep the original portal link, later edits and deletion notices together.

Record data

{
  "has_media": false,
  "sender_id": 70001,
  "sender_observation": {
    "display_name": "Morgan Reed",
    "id": 70001,
    "meaning": "Fictional person in a synthetic demonstration",
    "synthetic": true
  },
  "sent_at": "2026-11-01T14:23:02.163757+00:00",
  "source": "synthetic_demo",
  "synthetic": true,
  "text": "Case HBR-042. Keep the original portal link, later edits and deletion notices together."
}

#3New messageHarbor · Community · message 4022026-11-01 15:53:02 UTC

Alex Quinn · id 70002

Is harbor-check.example the new verification portal? The link arrived in a private message.

Record data

{
  "has_media": false,
  "sender_id": 70002,
  "sender_observation": {
    "display_name": "Alex Quinn",
    "id": 70002,
    "meaning": "Fictional person in a synthetic demonstration",
    "synthetic": true
  },
  "sent_at": "2026-11-01T14:27:02.163757+00:00",
  "source": "synthetic_demo",
  "synthetic": true,
  "text": "Is harbor-check.example the new verification portal? The link arrived in a private message."
}

#4New messageSignal · Announcements · message 4032026-11-01 15:53:02 UTC

Sam Vale · id 70003

Community briefing starts at 16:00 UTC. We will review the reported verification messages.

Record data

{
  "has_media": false,
  "sender_id": 70003,
  "sender_observation": {
    "display_name": "Sam Vale",
    "id": 70003,
    "meaning": "Fictional person in a synthetic demonstration",
    "synthetic": true
  },
  "sent_at": "2026-11-01T14:31:02.163757+00:00",
  "source": "synthetic_demo",
  "synthetic": true,
  "text": "Community briefing starts at 16:00 UTC. We will review the reported verification messages."
}

#5Edited messageSignal · Announcements · message 4032026-11-01 15:53:02 UTC

Sam Vale · id 70003

Community briefing starts at 17:30 UTC. Time corrected after the first announcement.

Record data

{
  "editor_id": null,
  "sender_id": 70003,
  "sender_observation": {
    "display_name": "Sam Vale",
    "id": 70003,
    "meaning": "Fictional person in a synthetic demonstration",
    "synthetic": true
  },
  "source": "synthetic_demo",
  "synthetic": true,
  "text": "Community briefing starts at 17:30 UTC. Time corrected after the first announcement."
}

#6New messageNorthstar · Research · message 4042026-11-01 15:53:02 UTC

Casey Lin · id 70004

The same numeric account ID appears in both chats. A changed display name is not a new account.

Record data

{
  "has_media": false,
  "sender_id": 70004,
  "sender_observation": {
    "display_name": "Casey Lin",
    "id": 70004,
    "meaning": "Fictional person in a synthetic demonstration",
    "synthetic": true
  },
  "sent_at": "2026-11-01T14:35:02.163757+00:00",
  "source": "synthetic_demo",
  "synthetic": true,
  "text": "The same numeric account ID appears in both chats. A changed display name is not a new account."
}

#7New messageHarbor · Community · message 4052026-11-01 15:53:02 UTC

Morgan Reed · id 70001

Support asked me to enter my recovery phrase at https://harbor-check.example/verify. Is that normal?

Record data

{
  "has_media": false,
  "sender_id": 70001,
  "sender_observation": {
    "display_name": "Morgan Reed",
    "id": 70001,
    "meaning": "Fictional person in a synthetic demonstration",
    "synthetic": true
  },
  "sent_at": "2026-11-01T14:39:02.163757+00:00",
  "source": "synthetic_demo",
  "synthetic": true,
  "text": "Support asked me to enter my recovery phrase at https://harbor-check.example/verify. Is that normal?"
}

#8Deletion noticeHarbor · Community · message 4052026-11-01 15:53:02 UTC

Telegram reported this message as deleted.

Record data

{
  "deleted_by": null,
  "deletion_time": null,
  "synthetic": true
}

#9New messageSignal · Announcements · message 4062026-11-01 15:53:02 UTC

Alex Quinn · id 70002

Updates will be posted here. We do not send private messages asking for recovery phrases.

Record data

{
  "has_media": false,
  "sender_id": 70002,
  "sender_observation": {
    "display_name": "Alex Quinn",
    "id": 70002,
    "meaning": "Fictional person in a synthetic demonstration",
    "synthetic": true
  },
  "sent_at": "2026-11-01T14:43:02.163757+00:00",
  "source": "synthetic_demo",
  "synthetic": true,
  "text": "Updates will be posted here. We do not send private messages asking for recovery phrases."
}

#10reaction.snapshotSignal · Announcements · message 4062026-11-01 15:53:02 UTC

Record data

{
  "complete_actor_list": false,
  "counts": {
    "👍": 3,
    "🔍": 1
  },
  "synthetic": true
}

#11New messageNorthstar · Research · message 4072026-11-01 15:53:02 UTC

Sam Vale · id 70003

Compare the saved announcement with its edited version. Keep the source record for each statement.

Record data

{
  "has_media": false,
  "sender_id": 70003,
  "sender_observation": {
    "display_name": "Sam Vale",
    "id": 70003,
    "meaning": "Fictional person in a synthetic demonstration",
    "synthetic": true
  },
  "sent_at": "2026-11-01T14:47:02.163757+00:00",
  "source": "synthetic_demo",
  "synthetic": true,
  "text": "Compare the saved announcement with its edited version. Keep the source record for each statement."
}

#12New messageHarbor · Community · message 4082026-11-01 15:53:02 UTC

Casey Lin · id 70004

Please verify your wallet at https://harbor-check.example/verify before the next briefing.

Record data

{
  "has_media": false,
  "sender_id": 70004,
  "sender_observation": {
    "display_name": "Casey Lin",
    "id": 70004,
    "meaning": "Fictional person in a synthetic demonstration",
    "synthetic": true
  },
  "sent_at": "2026-11-01T14:51:02.163757+00:00",
  "source": "synthetic_demo",
  "synthetic": true,
  "text": "Please verify your wallet at https://harbor-check.example/verify before the next briefing."
}

#13Edited messageHarbor · Community · message 4082026-11-01 15:53:02 UTC

Casey Lin · id 70004

Please use https://harbor-help.example/support instead. The earlier portal link has been replaced.

Record data

{
  "editor_id": null,
  "sender_id": 70004,
  "sender_observation": {
    "display_name": "Casey Lin",
    "id": 70004,
    "meaning": "Fictional person in a synthetic demonstration",
    "synthetic": true
  },
  "source": "synthetic_demo",
  "synthetic": true,
  "text": "Please use https://harbor-help.example/support instead. The earlier portal link has been replaced."
}

#14New messageSignal · Announcements · message 4092026-11-01 15:53:02 UTC

Morgan Reed · id 70001

No team member will ask for your recovery phrase. Keep it private.

Record data

{
  "has_media": false,
  "sender_id": 70001,
  "sender_observation": {
    "display_name": "Morgan Reed",
    "id": 70001,
    "meaning": "Fictional person in a synthetic demonstration",
    "synthetic": true
  },
  "sent_at": "2026-11-01T14:55:02.163757+00:00",
  "source": "synthetic_demo",
  "synthetic": true,
  "text": "No team member will ask for your recovery phrase. Keep it private."
}

#15New messageNorthstar · Research · message 4102026-11-01 15:53:02 UTC

Alex Quinn · id 70002

The request was deleted after we saved it. The captured text is still in the journal.

Record data

{
  "has_media": false,
  "sender_id": 70002,
  "sender_observation": {
    "display_name": "Alex Quinn",
    "id": 70002,
    "meaning": "Fictional person in a synthetic demonstration",
    "synthetic": true
  },
  "sent_at": "2026-11-01T14:59:02.163757+00:00",
  "source": "synthetic_demo",
  "synthetic": true,
  "text": "The request was deleted after we saved it. The captured text is still in the journal."
}

#16reaction.snapshotNorthstar · Research · message 4102026-11-01 15:53:02 UTC

Record data

{
  "complete_actor_list": false,
  "counts": {
    "👍": 3,
    "🔍": 1
  },
  "synthetic": true
}

#17New messageHarbor · Community · message 4112026-11-01 15:53:02 UTC

Sam Vale · id 70003

I was also asked to send a recovery phrase. The message came from an account using the team name.

Record data

{
  "has_media": false,
  "sender_id": 70003,
  "sender_observation": {
    "display_name": "Sam Vale",
    "id": 70003,
    "meaning": "Fictional person in a synthetic demonstration",
    "synthetic": true
  },
  "sent_at": "2026-11-01T15:03:02.163757+00:00",
  "source": "synthetic_demo",
  "synthetic": true,
  "text": "I was also asked to send a recovery phrase. The message came from an account using the team name."
}

#18Deletion noticeHarbor · Community · message 4112026-11-01 15:53:02 UTC

Telegram reported this message as deleted.

Record data

{
  "deleted_by": null,
  "deletion_time": null,
  "synthetic": true
}

#19New messageSignal · Announcements · message 4122026-11-01 15:53:02 UTC

Casey Lin · id 70004

The earlier verification link has been withdrawn. Check the announcement history before following links.

Record data

{
  "has_media": false,
  "sender_id": 70004,
  "sender_observation": {
    "display_name": "Casey Lin",
    "id": 70004,
    "meaning": "Fictional person in a synthetic demonstration",
    "synthetic": true
  },
  "sent_at": "2026-11-01T15:07:02.163757+00:00",
  "source": "synthetic_demo",
  "synthetic": true,
  "text": "The earlier verification link has been withdrawn. Check the announcement history before following links."
}

#20New messageNorthstar · Research · message 4132026-11-01 15:53:02 UTC

Morgan Reed · id 70001

Working note: one portal link found in the captured messages.

Record data

{
  "has_media": false,
  "sender_id": 70001,
  "sender_observation": {
    "display_name": "Morgan Reed",
    "id": 70001,
    "meaning": "Fictional person in a synthetic demonstration",
    "synthetic": true
  },
  "sent_at": "2026-11-01T15:11:02.163757+00:00",
  "source": "synthetic_demo",
  "synthetic": true,
  "text": "Working note: one portal link found in the captured messages."
}

#21Edited messageNorthstar · Research · message 4132026-11-01 15:53:02 UTC

Morgan Reed · id 70001

Working note: two portal links found. Both saved versions are included; attribution remains unconfirmed.

Record data

{
  "editor_id": null,
  "sender_id": 70001,
  "sender_observation": {
    "display_name": "Morgan Reed",
    "id": 70001,
    "meaning": "Fictional person in a synthetic demonstration",
    "synthetic": true
  },
  "source": "synthetic_demo",
  "synthetic": true,
  "text": "Working note: two portal links found. Both saved versions are included; attribution remains unconfirmed."
}

#22New messageHarbor · Community · message 4142026-11-01 15:53:02 UTC

Alex Quinn · id 70002

That portal link has changed. Both versions should stay in the record.

Record data

{
  "has_media": false,
  "sender_id": 70002,
  "sender_observation": {
    "display_name": "Alex Quinn",
    "id": 70002,
    "meaning": "Fictional person in a synthetic demonstration",
    "synthetic": true
  },
  "sent_at": "2026-11-01T15:15:02.163757+00:00",
  "source": "synthetic_demo",
  "synthetic": true,
  "text": "That portal link has changed. Both versions should stay in the record."
}

#23New messageSignal · Announcements · message 4152026-11-01 15:53:02 UTC

Sam Vale · id 70003

Case briefing: https://harbor.example/case/HBR-042. Use the saved messages as source references.

Record data

{
  "has_media": false,
  "sender_id": 70003,
  "sender_observation": {
    "display_name": "Sam Vale",
    "id": 70003,
    "meaning": "Fictional person in a synthetic demonstration",
    "synthetic": true
  },
  "sent_at": "2026-11-01T15:19:02.163757+00:00",
  "source": "synthetic_demo",
  "synthetic": true,
  "text": "Case briefing: https://harbor.example/case/HBR-042. Use the saved messages as source references."
}

#24New messageNorthstar · Research · message 4162026-11-01 15:53:02 UTC

Casey Lin · id 70004

Provisional note: these accounts may share an operator. Needs evidence before attribution.

Record data

{
  "has_media": false,
  "sender_id": 70004,
  "sender_observation": {
    "display_name": "Casey Lin",
    "id": 70004,
    "meaning": "Fictional person in a synthetic demonstration",
    "synthetic": true
  },
  "sent_at": "2026-11-01T15:23:02.163757+00:00",
  "source": "synthetic_demo",
  "synthetic": true,
  "text": "Provisional note: these accounts may share an operator. Needs evidence before attribution."
}

#25Deletion noticeNorthstar · Research · message 4162026-11-01 15:53:02 UTC

Telegram reported this message as deleted.

Record data

{
  "deleted_by": null,
  "deletion_time": null,
  "synthetic": true
}

#26New messageHarbor · Community · message 4172026-11-01 15:53:02 UTC

Morgan Reed · id 70001

I saved the original text, the edited link and both deletion notices for review.

Record data

{
  "has_media": false,
  "sender_id": 70001,
  "sender_observation": {
    "display_name": "Morgan Reed",
    "id": 70001,
    "meaning": "Fictional person in a synthetic demonstration",
    "synthetic": true
  },
  "sent_at": "2026-11-01T15:27:02.163757+00:00",
  "source": "synthetic_demo",
  "synthetic": true,
  "text": "I saved the original text, the edited link and both deletion notices for review."
}

#27reaction.snapshotHarbor · Community · message 4172026-11-01 15:53:02 UTC

Record data

{
  "complete_actor_list": false,
  "counts": {
    "👍": 3,
    "🔍": 1
  },
  "synthetic": true
}

#28New messageSignal · Announcements · message 4182026-11-01 15:53:02 UTC

Alex Quinn · id 70002

Case HBR-042 is ready for review. Refer to the signed archive for the captured records.

Record data

{
  "has_media": false,
  "sender_id": 70002,
  "sender_observation": {
    "display_name": "Alex Quinn",
    "id": 70002,
    "meaning": "Fictional person in a synthetic demonstration",
    "synthetic": true
  },
  "sent_at": "2026-11-01T15:31:02.163757+00:00",
  "source": "synthetic_demo",
  "synthetic": true,
  "text": "Case HBR-042 is ready for review. Refer to the signed archive for the captured records."
}

#29membership.serviceNorthstar · Research · message 4302026-11-01 15:53:02 UTC

Record data

{
  "action": {
    "_": "MessageActionChatAddUser",
    "users": [
      70009
    ]
  },
  "synthetic": true
}

#30coverage.gap2026-11-01 15:53:02 UTC

Record data

{
  "completeness": "unknown",
  "reason": "Synthetic transport interruption",
  "synthetic": true
}

#31connection.restored2026-11-01 15:53:02 UTC

Record data

{
  "completeness": "unknown",
  "synthetic": true
}

#32account_export.started2026-11-01 15:53:02 UTC

Record data

{
  "account_id": 70000,
  "job_id": "1d2efc3864d62b97867e6d70f7dfd8be",
  "meaning": "selected visible account data; resumable acquisition",
  "options_sha256": "49c2d765e37ee4980052fb314df71ee9db8a8366f8d58a7a30a616a53dc15bb6"
}

#33account_export.pageHarbor · Community2026-11-01 15:53:02 UTC

Record data

{
  "category": "messages",
  "count": 6,
  "job_id": "1d2efc3864d62b97867e6d70f7dfd8be",
  "receipt_sha256": "e95ae9b522e7a9a67ff70a610698a4db287a9389d7659617db97d6cdd81eec1e",
  "seq": 1
}

#34account_export.pageNorthstar · Research2026-11-01 15:53:02 UTC

Record data

{
  "category": "messages",
  "count": 6,
  "job_id": "1d2efc3864d62b97867e6d70f7dfd8be",
  "receipt_sha256": "1b71a3968bf1cc70375d0bf256e68c03eec713314a8ccb0b626c94d134e19882",
  "seq": 2
}

#35account_export.pageSignal · Announcements2026-11-01 15:53:02 UTC

Record data

{
  "category": "messages",
  "count": 6,
  "job_id": "1d2efc3864d62b97867e6d70f7dfd8be",
  "receipt_sha256": "0735cdd056ca23a7c2f2c6373ab3f029f79f38917182dd3d5c3d055842e41fc1",
  "seq": 3
}

#36account_export.completed2026-11-01 15:53:02 UTC

Record data

{
  "complete_within_scope": false,
  "counts": {
    "bytes_saved": 0,
    "media_saved": 0,
    "media_skipped": 0,
    "messages": 18,
    "messages_exported": 18,
    "messages_seen": 18,
    "records": 18
  },
  "job_id": "1d2efc3864d62b97867e6d70f7dfd8be",
  "receipt_head_sha256": "0735cdd056ca23a7c2f2c6373ab3f029f79f38917182dd3d5c3d055842e41fc1"
}

#37process.started2026-11-01 15:53:02 UTC

Record data

{
  "coverage": "No collection while process was offline.",
  "previous_observation": {
    "hash": "27bce84673362bef0da027778322104e3cde06e156d54d4fdc59e6ab7149d4e4",
    "observed_at": "2026-11-01T15:53:02.373+00:00",
    "seq": 36
  },
  "run": {
    "account": null,
    "attestation": "self-reported collector measurement; not an independent attestation or trusted timestamp",
    "capture": {
      "download_media": true,
      "max_media_mb": 20,
      "record_disabled_media": true,
      "types": {
        "animation": {
          "enabled": true,
          "max_mb": 20
        },
        "audio": {
          "enabled": true,
          "max_mb": 50
        },
        "document": {
          "enabled": true,
          "max_mb": 50
        },
        "photo": {
          "enabled": true,
          "max_mb": 20
        },
        "sticker": {
          "enabled": true,
          "max_mb": 5
        },
        "video": {
          "enabled": true,
          "max_mb": 100
        },
        "video_note": {
          "enabled": true,
          "max_mb": 50
        },
        "voice": {
          "enabled": true,
          "max_mb": 20
        }
      }
    },
    "dependencies": {
      "cryptography": "50.0.2",
      "fastapi": "0.162.0",
      "qrcode": "8.2",
      "telethon": "1.45.0",
      "uvicorn": "0.54.0"
    },
    "monitoring": {
      "deletions": true,
      "edits": true,
      "membership": true,
      "messages": true,
      "reactions": true
    },
    "monotonic_ns": 14064250000000,
    "network": {
      "fallback_to_direct": false,
      "has_credentials": false,
      "kind": "mtproxy_auto"
    },
    "os": "Windows",
    "public_key": "JZffQIo/Zf7+JbiSSocJ9i3eO5ntxhp/aDpVZ+3onfg=",
    "python": "3.12.10",
    "run_id": "21f6c35c6fc6447d872f3abd826a16ec",
    "software": "TgWitness",
    "source_files": {
      "__init__.py": "274046d13cef65c23ba92bc40a3d204e53c61187673b2c5dfd34f90b599a8c57",
      "__main__.py": "3637026fd42d4ef421547914322ac702233bd05eb60e56e6e83096047d3d1cfa",
      "access.py": "68bb673fb659cf542ecd6af63c057a92c88928a7c3073b918846914994da2e3f",
      "account_export.py": "9a556c242c3c9ec38030dfcce9b4abda01b42815badb35b554a7d17d153975ec",
      "account_export_transport.py": "dace905308d5aaf5e5a64599aa26d84091212bffada4aa3da6cc2cf306134fed",
      "account_import.py": "4f7501ec8f6211f65db9587daf0a770f090edcccd81b48477dcde393ae087a3a",
      "ai.py": "7073b7dc13a812a54b35a8cc00c19ae8e8b7511a963c05466f360adf44660b45",
      "alerts.py": "719c330ecb83baf6d0f3f566b630d9de843cdf431f925706e22191f8234dbfcc",
      "analysis.py": "bed7d22c36713dc3924fcce2176111bbc3d28eb487881e342460ec6313a5c131",
      "analysis_api.py": "23bbfac1b4d6e274fee27f389d31aa5fe4e5677086ebdc222e8318aa476ff8d6",
      "anchor.py": "47411bd08d50a69517b9fa9b145b227747cfdb851f7b451c65790b86c629416c",
      "anchoring.py": "d42d1a4c75ba5f3173d63105c4a732ec042ec8789c07b775d16a2b181e8bb473",
      "api_pool.py": "6290dc75b1febbdfa7f95bd0cf14f9a9b04618e6d2ca6829967947399ffacb46",
      "app.py": "d0358a6dbf4b0f9e64b482136e782a4fc2539075ded3eced94950ee3c15b3a80",
      "archive.py": "c01b74a0df2e7136ba2658d08450e9ea3b09b92c4a0fc8d85abdfed4c53ea619",
      "archive_api.py": "f2b628e94fb3d2ed73fcef4df852a02e7b12c87b2bb9e81fd4d2e3956f9811b4",
      "assurance.py": "7e9b1bd3e65d0d54ee791c8731fb3fc79a39dd258c9df4b39969e266426b5f5a",
      "avatar_history.py": "c1a518211181434bc4f9641d21ebea3fb1625b906e302dc59dd3c047353d8316",
      "capture_proof.py": "b361a88dc381d052347be515e36a41f6a240b475871b8b3ea18d39df57e8103a",
      "chat_export.py": "075ca9c5bc501ff098f9e571e8e0aba4f7a69b26c3e25b7c70582850245e841f",
      "cloud.py": "e4b9f639390fa1e1a2492d0faf2246b04111be4f40f6dddf9d71c3d627ab01fe",
      "collector.py": "9287f971dcbd735e40867be8d796b512dca6156c4b072e59a0a93b0a43c81f12",
      "continuity.py": "13eaee2ff707465e695b7101f1648a8407845b1146cf3315c54a6aa043e7f627",
      "demo.py": "f0a452f471508768c8dbd6da7b2b96df4e6f076b10ee5024206296dbdc9627d5",
      "disclosure.py": "f63764cde4e62323e24ab0ea46782e10eea4406f2427d2887e007a289f719077",
      "doctor.py": "7d01a81e238a64538cf7c02c513dfe8836e3452666627c76828c0589ced21bf6",
      "dossier.py": "bd958c4968d830fcf5b835f53da78d0541524255ca3f03bf8f42da95c140876a",
      "download.py": "23d08c66a1b22b3f0cf41c4dc05ce927480a0d7a76600fcf094de8379b06dd7d",
      "downloads.py": "c3787b72bfabf9645e8b7c9a8f1c9c08e55c9395c8ba97a5693bca9c34e7e10c",
      "evidence.py": "60c5e8f67bce139e8fdd6244d00da8a74b578b594276ddffdafed3b9cb2f3937",
      "export_history.py": "a5e9b259081acceb1a3c86ff4fa7b60c7f406741a95a87c922504652eed1a02c",
      "health.py": "cd0a04efb51f22a758dca0cd5dea5b1f7723c5014733b77a84744d837eaa628a",
      "history.py": "b588dcfbac7875518e99758b9134ebcac92b278cf82d18085da57e55299a1fb0",
      "i18n.py": "642418b5f33a9e10c63d772db293962ea39bf19b9ccfb01f5dae1d6825fc5bf4",
      "interactions.py": "07e5404dbbfc4170b8e1c3bbc1fc29b818c9b2065bc7435fb50e1269d0d7bb31",
      "journal_index.py": "652b8319a4d4c68c512f2c2914f33ebf1fae98cf2248d7e084f01c72c6b26308",
      "keyboard.py": "f64acbea8a86a8a795c92bb452f64208b159a45158a7e487fb1c2d7163864ba2",
      "live_stream.py": "bec211096e2fdb453884e0444dee0b0a317de28b9729783eb3b8a7aa581ef638",
      "logging_config.py": "e0cd7564921c4be828befc0fd769e0139f30dd3afccf47a08f1118761c565eba",
      "mcp_bridge.py": "ab2020691a98098c2cf68dbba722a816786f2b106bcb1f488130f6f13503c82d",
      "mcp_server.py": "fc6c5c0ef33edb6cc36ea18eb84517a42bac6098c1649726f0ec110d25c9c765",
      "mcp_stdio.py": "bb482efcde1a439143d7bbf5c886bbdef34d8a7266edc2d98d378b7682342d8a",
      "mcp_transport.py": "690fd68ae18ebaf66db41a3d876c761b314e5daa566e1779f614f14276560277",
      "media_analysis.py": "bc988b9455c99f4b5397d558a967cf16e94acebf576b363d5ba967b36fb17d78",
      "media_analysis_api.py": "0fd37e70136d0c403a0dac42208629f817235758ec178732a23203467a917d45",
      "media_preview.py": "197a521e682f8147a1a444360b35949ce8c7d351d97d4d0a5cb23f2949ad6204",
      "message_content.py": "97af1afee089ac02ef1d55cea894f3029df826f1a0a2657f326b1657080fb549",
      "middleware.py": "c608218712f77de96853b8d821b21dc55aa7aa088e12afa5e4f745db754cef21",
      "monitoring.py": "2e3431853931815e5d035f9f2a95a46d1045974286b776feec082ee577ea6457",
      "multi_export.py": "2267d7bf9f037d29ecfd9706f2594a0632ee646228b8c5b6e05f2aa9be9c36fe",
      "netclient.py": "762ab484931c73336ce2ac70d840aec7229119e83037e21e1581801fdbb760b5",
      "network.py": "d14050ebecc701cff4f73f988cee64729b228beabdce0f36f9f3bd6b465e863f",
      "panel_routes.py": "07237731322dbb8dad2f6386a858106dca0a512f9618c9a84bc5bce49de58d98",
      "profiles.py": "01f87ee6f77320631d43d3bd580039711ab0710f8e12eb0a45437f2cb23a4fbc",
      "proof.py": "5705135f6ef0c268dc36b690222c815946caf831af03d7eac285ba29df3e93fe",
      "provenance.py": "e8cfaa5ef91bcb56aa2a4d6b7fdc9d74986b374de451066414c4ab19a8d8b90b",
      "providers/__init__.py": "54b63a36cf1be06ce29c43c6693933269ffb80ab251c23941282516d21b94d2b",
      "providers/aws.py": "0b771ed8526bf1475ebae90a8336ac18824339f5325b63bd88f42a0acd72f3e9",
      "providers/base.py": "0506c1aaaae94b993593d6beb7de5021f6b5e41b37587c46d6e20d132aec579e",
      "providers/digitalocean.py": "498a9ad86875591d04be155bea134703b92b639d735b7e67be5a829c935460b5",
      "providers/generic.py": "d74aed6db7257f37484526f8b93534b73c2c03b52d3cf7d125c838c15e71e250",
      "providers/hetzner.py": "b6981afd2ec5c7205e30966156c408c246fd14569ed59be132a9212c06ecabf8",
      "providers/linode.py": "146fa73208c791e78fed04cc9662cb0ed68327054b43a8ac9192a974f40b3233",
      "providers/vultr.py": "cb0dddb0996524bec246c2222a3596a0d7c505d8b134471d72ea45e3c457d55e",
      "proxy_catalog.py": "027f7287ab3bb5da8845860f7ac2ecce3fd0573b5fc21d5afef2d80f3e79a75e",
      "proxy_sources.py": "bb59ffd125d1a9d9dec14a245867e8b54ab0e28a39e676f9e8a9da8c009a5670",
      "recording.py": "ab865813f7e4ad17703e4c9d30faa36490faba8c3e47cf74e6345d76904009ae",
      "replica.py": "8079964b068876003d03c76f1bc7caf4301bae6b413e8d13ba041b384f3bc295",
      "report.py": "8b542e31c0f1f773505ef50b65308e040561e20fec7fa62077a67177441b66c9",
      "s3.py": "7dee62beb868ebc3acf30da9cda811046c24ac6ec8f0a72d31b7ed5f5fdb0ae2",
      "scope.py": "13d4097b50fc172488ff4e6a67b1d3ac9e0bab45aab16bca014fcd816b417ecb",
      "sealed.py": "4bdeb97cbc5e72981e61f50401b344050c66bfb49310841be482abe8b2a916e7",
      "sealed_crypto.py": "20cad350a88e1487aea585cfc76e5f4d056a81255619d5d61a136d01c99001f5",
      "sealed_package.py": "5c5b44265728f6c264ce9709f6dccc6c7337965999ab6e2bd2f3fecd066927ea",
      "sealed_verify.py": "1619c0b012b3af41ccc85d0010d41bf67dbb466c8e0e7d56cbd075e30fe6f12f",
      "security.py": "28e6cde319037bec6296c8d29152a315e7bab12b220e355030ce53f4e356b181",
      "sessions.py": "cfac0581572a7cfdfabe8f24486f7fbbd37fd71696f7a933af2c79897ea5de1b",
      "source_check.py": "dd8a1ca4e70a54948efcf6776182b74abb1ec51603ec883042da188c68c25889",
      "static/analysis.js": "cd083e02c2205a8c621f563e1c1e5ff12bd324bb758125f2f6a86eea9b475391",
      "static/app.js": "c2ec5b8ceb4840190ef48fbfc01902181ceb95ada3a04f8130dd86ae900d1811",
      "static/capture.html": "f1f3fd21a2744122e59a94e1fb142156bf93669eda0552d27de6d93ed357ca34",
      "static/cloud-capture-locales.js": "42c9fd2962b51e5b7120217576dfd37d749982bedfa9edc9c92acf5103d0c9eb",
      "static/cloud-capture-story.css": "d69f232b3e6c0fe80e3a8bf52729ceec0fc68d3b1c74797ac0420d22e7637428",
      "static/cloud-capture-story.js": "7cd1f230c15282417109f6392d38906c35a9d97ddd9033344052e23e21e62a03",
      "static/cloud-capture.css": "7031172a365532a09d9880c94e87ee84e93e2b57ca26f6e2b5585adf4658494a",
      "static/cloud-capture.js": "8afb5281091d2d9da844f4baa818b7e1b54c9c76035a4c4b7306d5435f923335",
      "static/components/collection.css": "77b09a761d2cf5157b2888d902058fc5cc7cee91d5a14bfecef223d5ea48a5d7",
      "static/components/collection.js": "0f83a5fe6ee5a474a538ee5581a3bbc3da8b6fd016292c89d3abdd07816a5baf",
      "static/components/connection-notice.js": "c1bf46498f9b65a537dd90ef8954910033ffea557c994e9eb88d9e559df00fe1",
      "static/components/feedback.css": "56e377c0fa56250e359a60aebd6650ec7b4747c05ed684e383c28fe1f5e77bfb",
      "static/components/forms.css": "7e51842ea6ddb945bbc74b363722f99d8c669507777ffb8f8854351afae3edcd",
      "static/components/forms.js": "a66520b0eb73c55ad2a350c8eccfc0d9bbb179d014a88057df542a5595cec8bd",
      "static/components/health-actions.js": "3016acc2d3853f18efdbe3a2a48550e621df6137b8bd2e4c29ac98164f006a90",
      "static/components/health.css": "b923d0d8a14b73f914ff200a8db699013ecd0fccfcefb295b3b654fa78234d74",
      "static/components/health.js": "bc937d31da0f6a29867a56a584505c72d43d35667349910d895bf291dd5ade95",
      "static/components/journal.css": "7a25e97ec2a86a3b17f46041be4c637775114e7f0c2c893b9e216a2028d487fa",
      "static/components/journal.js": "446751e778dfb15d61c2ad5ab4259b0cc5ddf4b516c4ac568e65317c8bda8604",
      "static/components/notifications.css": "ab4ccad1f12e41875694526f1736e1a01d1bd74682cd28d29cfa444d61edf6f5",
      "static/components/notifications.js": "3e432cce7dfd1c59ac830c2c6cf93ffc371256f71cd85393fc15026a150d2dfb",
      "static/components/shell.css": "afa8268dde50a6458705ef11f40560e3dac88635648d2687f405f9c10080a99b",
      "static/components/shell.js": "65fa344057faa0096138209a6f60eef64a19732361ed57600acca0ce84857e55",
      "static/components/workspaces.js": "d66d0283f0bacf8a3d94cc1238eeddf44655302ebecdd31c66cecdd888569bea",
      "static/core/time.js": "e454d952ec5036a4a1136debeb384dda93bbb90c05bfe99e12eb31d545a72414",
      "static/core/view-host.js": "9a8dc5386a17721e7de7251fcdc1c8ad9a2a2f57153d28e3a946409d3e291445",
      "static/dedicated-account.html": "23169b95740d310033c1f87a3fa8673813a0999b71cc0672f564606a9be83127",
      "static/fleet.js": "1093407e8d88795a46213f5adca32f552949abaddbe46704c65bf279c3ce2eae",
      "static/guide-locale.js": "857ce6b546a56769becb29922afc26599b1f3f2134887aaa1572e493f970c880",
      "static/guide.css": "beb7eabeb61b7b15cc583dbdbe7b4b9bda36aecee1a3606a6f5b67b9b7837dcb",
      "static/guide.html": "6c2dff57824a59dbf9d07db1ba9901021180c2994213c5288b16f9c48f75cf58",
      "static/guide.js": "3933b50f4efd9468dab5dd99592b5c0969f236873fd0a40b16ef02caba698af7",
      "static/i18n.js": "612e57bb5e2e982b5f15a312d8892ab62e4b141b4e426c2e5411f926cc8dc50b",
      "static/index.html": "8bb920ae973b75783480b77470d087280a3e37716900583de435e6ac06f1e1c8",
      "static/integrations.js": "77749031acaf06d1d2b60f212ff583a20badf32b3ba71cc0a794f636bbbc9b51",
      "static/live.js": "c644a8afcb05f1b81dff37a1666c5181d8e95d6f07081afa356516482abb8f98",
      "static/mark.svg": "94b82a64f9ac89febe67268fda8575194693ccaba3d89477f270839a636c82dc",
      "static/media-analysis.js": "f22ac158d20d7db27bce06eca6485f3cdd85787c1e828af169e2bd8eab15e154",
      "static/proof.css": "0bf9d11ef007382263a2c7cd8b30968c743dc96d16106eb1d9e35050217b2347",
      "static/proof.html": "37d58ada5a40e4e07a0e160f4f7d88b8103b1f68c23d10c652f5f8eee118a696",
      "static/proof.js": "3126a3bb6f222122b045d8c057c55778b42309c028e2039fbfd8b9db1fae118c",
      "static/proxies.js": "c832a2fd31c7791dd0d34610762414562800c79c83128299b6c0bad524fc9949",
      "static/review.js": "1e56df64171b2fedf74b842ffa7b30723aca0fe5ca20cc3ac4645decb17292bf",
      "static/router.js": "188c3490b1fa64534d0f26e7de59d03bbbb240779a8c63d33dbfbb613f4428fa",
      "static/sealed.css": "e4bfac08b8b0df5212561bfdeef4b3833afbf54e91af5574965a9abe546e12a9",
      "static/sealed.html": "4de605b9b907f5fa65e144722884026cf1e377da129d7df448298c5f82fc91fa",
      "static/sealed.js": "6545dc24c256d15754f3ffceb1d41a6ff308adcf3f1084ef23192a5f9de0f19a",
      "static/style.css": "1a381aee5bf518dcd89d95100cb2200b7bb81531cb75069638ab5d7f1d075034",
      "static/theme.js": "45dbe3c42d4c086a3ee55fa86555414f2b2c3021014e3a319baa6e8e93ea4b5f",
      "static/views/access.css": "1e7e5849ebd9096af0c0c8a97538263900863fef96d2ec78d8092e4221125506",
      "static/views/access.js": "b57264a004f907f73879acbf8443e73c1a708e81f0e2703c112492ee7d6ee56e",
      "static/views/accounts.css": "713e44fbc3f4439e421bf011066e7e6dcdb93a06e5e9ff14042b35a48f7af8af",
      "static/views/accounts.js": "35248bfb2077ba1f18bfb9a56e9f8e5af2c3de26f4efe355b8fe82e04d5eda7b",
      "static/views/chat-list.css": "0397e16104b30c0df4a290d9257e5b68400b75e154e6a7432922b2419c8a90e2",
      "static/views/chat-list.js": "b17fbba30cd6830ce7359d4a923dd4de9392fd8476cc1c2d3a01f852843610ce",
      "static/views/chats.css": "1143e361348f4ace38d7487b5983233d140ec2d4f5e355330789c58d9dacfbcb",
      "static/views/exports.css": "7c99bb31d83a152e2f1ae108e456ed7aa5fe4ac1f647492ed62e76ed16e44fe9",
      "static/views/exports.js": "3be718ba56f0c4007ce622348f098602fcab694adea8fa8a6f5c420c151b95dc",
      "static/views/parameters.css": "db9938d2ad4687d7c394a993d4be50476bef121d3f66db92ce56e1bdd5646160",
      "static/views/parameters.js": "8e08c2493a86b19a4209c53c2cb40a1507dc75651666b95fc6e307cd9eab4c40",
      "static/views/sources.css": "6aa6e0598bfc0d0b059bde3463c2d48e4e6603b73a26d6410a45d1fae853793c",
      "static/views/sources.js": "c4348f5f8159f85395160924c550a468aab5baea2fb58dd2652250e2eb249510",
      "static/views/system-log.js": "419261d0b738ee06f2fb72adbc2385d30cd10a582603e29cb82b7eca43ef63f2",
      "static/webhooks.js": "23996122140d253c6bf8167f4a892d61bc5e3ecb670e5da066e4dfe50a4006eb",
      "store.py": "3a01aef7c085de632eac00f5fcf21b1b2be910d0df93dc04245d8b7482612afe",
      "tdata.py": "0fe721dc2dd44176f6b04511dc97cc8128a359f81cc461e2b8be96ad3fbbd4c2",
      "telegram_client.py": "ba7a65e411d104415a733040a9ad50b90d8e8b09795abfa45ba5b617549a1abd",
      "tsa_roots.py": "64d5f65928cc3ba52c178739350a393f38ac6808f4cacd6c29088a21c6ebac7d",
      "tuning.py": "ed8bddef2f9cf0d4b72b12fc8775831c962c59b04152eca5b6de1c2875db415f",
      "verify.py": "23ef9a1bd9c4a5cb6c72402ca46b730bf745fa40b5b96fbbf1eb14ed9c49aa8e",
      "webhook_api.py": "8c7ebb533ad801229531efc9355b1384da18eb99332ba6da31a6275120947ce4",
      "webhooks.py": "20befab2424ea97b97ba8327b90933c57356047fc35f9e397bab9d595b882d56",
      "witness.py": "dc2b8217e3c32bccb03a7f55d94ecbc35e2acfe2126fa70eae519f13305f0133",
      "witness_api.py": "409778e38d35544bac1ce860213f7ecfb78fccb4be0c75883c7ec65555cafd47",
      "workers.py": "3be5a646a542c11bef13c135bd3a46cc94749364f691e452bfec16e8f27450a4"
    },
    "source_tree_sha256": "8562a09f805160e18fbc6b8b036c1dc9386905dbb354987f2baab238e7fdd1ac",
    "started_at": "2026-11-01T15:53:02.621+00:00",
    "targets": [
      {
        "chat_id": -100100002,
        "enabled": 1,
        "kind": "supergroup",
        "origin": "manual",
        "priority": 1,
        "title": "Harbor · Community"
      },
      {
        "chat_id": -100100001,
        "enabled": 1,
        "kind": "supergroup",
        "origin": "manual",
        "priority": 1,
        "title": "Northstar · Research"
      },
      {
        "chat_id": -100100003,
        "enabled": 1,
        "kind": "channel",
        "origin": "manual",
        "priority": 1,
        "title": "Signal · Announcements"
      }
    ],
    "vault_key_mode": "local",
    "version": "0.7.0"
  },
  "version": "0.7.0"
}

11Seal

This file ends with a signed seal: the SHA-256 of every byte before it, what it describes and the case details, signed with the key above.

Report ID	`3f5094c1-8c5a-4cd5-b2a0-798d2b52846c`
Sealed at	2026-11-01 15:53:13 UTC

Drop this report file here to check every byte in this browser. Nothing is uploaded.

Choose the file