# Follow the message. Understand the evidence.

Canonical page: https://phishdestroy.github.io/TgWitness/docs/

Get your first capture, explore how the proof works, then build the setup you need.

[THE INTERACTIVE FIELD GUIDE**Make a change. See what the proof catches.** Play a message’s history, alter a record and follow its hash. Explore the visual guide](https://phishdestroy.github.io/TgWitness/docs/concepts/) [## Modes, scenarios and evidence levels Collection scopes, event boundaries, eight verification mechanisms and six fictional investigation scenarios.](https://phishdestroy.github.io/TgWitness/guides/modes.html)

## Your first captured message

[### Start in minutes Try TgWitness with sample data, then launch your own Telegram observation workspace on Windows, Linux or macOS.](https://phishdestroy.github.io/TgWitness/docs/start/)[### Dedicated account Prepare a separate Telegram account for collection.](https://phishdestroy.github.io/TgWitness/docs/dedicated-account/)[### Connect an account Connect Telegram by QR code, phone number or session import. Choose sources and check that new messages reach your journal.](https://phishdestroy.github.io/TgWitness/docs/accounts/)[### Choose a proxy Maintain automatic MTProxy routes or use your own proxy. Choose IP modes, fallback rules and the route for external requests.](https://phishdestroy.github.io/TgWitness/docs/proxies/)[### Export and verify Export captured Telegram history, verify signatures and compare a journal with a checkpoint retained by an independent witness.](https://phishdestroy.github.io/TgWitness/docs/exports/)[### GitHub Actions capture Export one Telegram chat on a temporary GitHub runner.](https://phishdestroy.github.io/TgWitness/docs/capture/)

## Learn by trying it

[### See how evidence works Follow a message from capture to checkpoint. Change a sample record, recalculate its SHA-256 chain and see what a retained checkpoint detects.](https://phishdestroy.github.io/TgWitness/docs/concepts/)[### Investigate across all chats Run an end-to-end Telegram investigation across channels, groups, private chats and bots: whole-account capture, history, people, links, files, timelines and verified evidence.](https://phishdestroy.github.io/TgWitness/docs/cases/)[### Keep it secure See where sessions, keys and evidence live, what leaves your machine, what the protections cover and how to harden an installation.](https://phishdestroy.github.io/TgWitness/docs/security/)

## Add only what you need

[### Work the archive Load history, search saved records, review AI sources and connect your tools.](https://phishdestroy.github.io/TgWitness/docs/archive/)[### Share a case Give reviewers and analysts access to selected accounts and chats, with separate permissions, session limits and revocable tokens.](https://phishdestroy.github.io/TgWitness/docs/access/)[### Set up a witness bot Publish signed journal checkpoints to your Telegram channel with a separate witness, its own key and read-only collector access.](https://phishdestroy.github.io/TgWitness/docs/witness/)[### Keep it running Run TgWitness on a server with persistent storage, private panel access, backups and checks after a restart.](https://phishdestroy.github.io/TgWitness/docs/server/)[### Find what went wrong Check panel access, Telegram connection, missing messages, FloodWait and witness status using the right signals for each problem.](https://phishdestroy.github.io/TgWitness/docs/troubleshooting/)

## The complete reference

Every document of the project, rendered here with its diagrams. The guides are the short path; these pages hold every detail.

Set up

[Quick start](https://phishdestroy.github.io/TgWitness/docs/reference/quickstart/)[Accounts and session formats](https://phishdestroy.github.io/TgWitness/docs/reference/accounts/)[Access and permissions](https://phishdestroy.github.io/TgWitness/docs/reference/access/)[Connection, proxies and data protection](https://phishdestroy.github.io/TgWitness/docs/reference/connection/)[Deployment](https://phishdestroy.github.io/TgWitness/docs/reference/deployment/)

Collect

[How collection works](https://phishdestroy.github.io/TgWitness/docs/reference/collection/)[Load source history](https://phishdestroy.github.io/TgWitness/docs/reference/history/)[Workflows and operations](https://phishdestroy.github.io/TgWitness/docs/reference/operations/)[Investigation mode](https://phishdestroy.github.io/TgWitness/docs/reference/investigation/)[Features and limits](https://phishdestroy.github.io/TgWitness/docs/reference/features/)

Archive & integrations

[Archive analysis](https://phishdestroy.github.io/TgWitness/docs/reference/analysis/)[Read-only MCP](https://phishdestroy.github.io/TgWitness/docs/reference/mcp/)[Local OCR and transcription](https://phishdestroy.github.io/TgWitness/docs/reference/media-analysis/)[Outgoing webhooks](https://phishdestroy.github.io/TgWitness/docs/reference/webhooks/)

Evidence

[How the evidence works](https://phishdestroy.github.io/TgWitness/docs/reference/how-it-works/)[Evidence format](https://phishdestroy.github.io/TgWitness/docs/reference/evidence/)[Independent witness](https://phishdestroy.github.io/TgWitness/docs/reference/witness/)[Timestamps](https://phishdestroy.github.io/TgWitness/docs/reference/timestamp/)

Security & project

[Security and data handling](https://phishdestroy.github.io/TgWitness/docs/reference/security/)[Architecture](https://phishdestroy.github.io/TgWitness/docs/reference/architecture/)[What has been tested](https://phishdestroy.github.io/TgWitness/docs/reference/verification/)[Licence and architectural incompatibility notice](https://phishdestroy.github.io/TgWitness/docs/reference/license/)[Operator incompatibility notice](https://phishdestroy.github.io/TgWitness/docs/reference/notice/)[Changelog](https://phishdestroy.github.io/TgWitness/docs/reference/changelog/)