Investigation mode

Follow a case across channels, groups, private chats and bots, from initial acquisition to a cited timeline and verifiable handoff. The interactive website version is at /docs/cases/; preview instructions.

Worked case: a destination changes across four conversations#

An announcement points to a bot. An operations group discusses a new payment destination, the bot's keyboard displays it, and a private follow-up repeats it. The announcement is then edited and a group message disappears.

The questions are: what was observed before and after the change, which Telegram accounts posted each item, where the destination appeared, which attachment bytes were preserved, and what intervals remain unknown?

All names, IDs, times and journal references in this example are fictional. The workflow uses current features; the case map is an illustration, not an automatic graph generated by the application.

Diagram as text

1. Channels → Workspace journal
2. Groups → Workspace journal
3. Private chats → Workspace journal
4. Bots → Workspace journal
5. Workspace journal → Search all sources
6. Workspace journal → People profiles with record references
7. Workspace journal → Saved versions and attachment receipts
8. Search all sources → Analyst timeline and source register
9. People profiles with record references → Analyst timeline and source register
10. Saved versions and attachment receipts → Analyst timeline and source register
11. Workspace journal → Signed evidence ZIP
12. Analyst timeline and source register → Case handoff with separately verified artifacts
13. Signed evidence ZIP → Case handoff with separately verified artifacts

1. Define the case and collect the whole account#

1. Connect the collecting account in its own workspace. In external case notes, record the case reference, account ID, workspace, observation start and trusted signing-key fingerprint.
2. Open Sources → Observation scope → Investigation mode. The preset selects Whole account, channels/groups/private chats/bots, own actions, source profiles and the latest 200 visible messages for newly discovered sources. Review it, press Save scope, and complete the scope confirmation.
3. Load chats and compare the sources with the account's dialog list. Check exclusions. Parameters → Chats read from the account's list defaults to 1,000 and allows up to 20,000. Sources beyond the list limit are added when they become active. Record what was actually enumerated.
4. In Recording settings, select All visible activity and save the monitoring settings. Review attachment types/limits and free disk space.
5. Start observation. Validate a controlled new message, edit and deletion, then retain the test references and any failures.

Whole-account scope records account-visible activity within the saved settings. It does not access secret chats or automatically join every linked group. It also does not backfill every existing conversation. See collection scope.

2. Inventory every source and acquire historical context#

Keep a source register with one row per chat:

Use the right acquisition for each source:

• Load full history in Sources (current main) loads available past messages from enabled sources into the workspace journal. It supports pause/resume and a signed progress report. See history acquisition.
• History snapshot saves recent visible messages into the observation journal. Its default maximum is 500; Parameters → Largest history snapshot can raise that to 10,000. These are current history observations, not reconstructed edits.
• Full chat export → Export full chat, or Chats → Export chat, fetches the currently visible history of one chat into a separate signed chat.json / chat.html bundle. Repeat for the case's sources and retain each result.
• When a new chat or bot appears can save its profile and up to 1,000 recent messages; Investigation mode selects 200. Existing chats do not receive that intake retroactively when the mode is enabled.
• Download visible attachments preserves bytes under the configured policy. Require a completed media.saved receipt with SHA-256 and byte count. A queued job, thumbnail or filename is not the preserved attachment.

A full chat export does not populate the journal or people profiles with all its messages. Use Load full history or bounded journal snapshots for history you need to analyze inside TgWitness. Review the enabled source list before starting a history run. Neither route recovers material Telegram no longer returns.

3. Preserve the evolving case and deliberate interactions#

Star active case chats as priority sources. Review recheck intervals, continued catch-up and media outcomes. Keep the collector observing while using the account. Use Chats → Profile → Save profile now to retain source metadata such as descriptions and bot commands. This is separate from people profiles derived from saved messages.

Where the case involves following a source or interacting with a bot:

1. Open Telegram link → Save preview records the supplied link and returned preview before an action.
2. Join / open and observe performs the join/open, and sends a bot's start parameter when supplied. A join request awaiting approval is recorded as pending.
3. Panel-issued text replies and supported button presses retain interaction.requested and interaction.result. Callback receipts can retain returned popup text, alert state and URL.

Those are real account actions. Callback presses in another Telegram app are not visible to the collector, although resulting messages or edits may be. The mini-client does not perform web-app, payment, phone or location workflows. For exact behavior, see panel interactions.

4. Connect observations across chats#

In Journal, select All sources and search recorded content. Open matching records and retain the workspace, chat, message ID, sequence and record hash.

In a relevant chat, open People → Turn on profiles and inspect a person:

• Names/usernames observed over time and the numeric Telegram ID.
• Reply relationships with source-record references.
• Also in… other chats in this workspace journal where that ID wrote.
• Activity, edits/deletions and mentioned wallets, phones, usernames and links.
• Saved avatar metadata and similar cached avatars, with their separate origin.

Open the cited records before using a derived profile in a finding. Profiles cover people with saved messages, not every member of the group. Parameters → Records cited per fact limits the reference list, not the underlying activity count. Mentions and avatar similarity are leads; they do not establish ownership or identity.

In the worked example:

Compare attachment hashes and their associated message references. Identical files do not establish a creator, forwarder or common operator. Equal names and similar avatars alone do not join two Telegram IDs into one person.

5. Build the cross-chat timeline#

Use saved versions in Chats and their Journal record #… links. In Journal, combine All sources with Edits, Deletions and Coverage. Keep both source_at, where supplied, and observed_at.

Other records occur between these example references. Sequence numbers order observations; history snapshots can contain older source dates and arrive later than live events. Distinguish snapshots, recovered messages, deletion notices and missing-on-recheck outcomes. Mark coverage gaps as unknown intervals. Later history acquisition does not retroactively establish uninterrupted observation.

6. Add account perspectives without losing their origin#

Use a separate workspace for every distinct account and repeat its inventory. Keep account ID, role, signing-key fingerprint and source references with every comparison. Message numbers are not global identifiers across chats/accounts.

Cross-workspace correlation is performed in external case notes or analysis tools. TgWitness currently has no global cross-workspace search, merged timeline, investigation graph or combined case archive. Multi-account export of one channel/supergroup is a different operation, not a merger of the account journals.

For longer work, retain boundaries with an independent witness. Use controlled delivery checks to qualify each account's capture path and visibility.

7. Assemble and verify the case handoff#

Keep these together in an analyst-assembled case directory:

From a trusted installation, with filenames and each workspace's actual fingerprint:

python -m tgwitness.verify evidence.zip --fingerprint TRUSTED_PUBLIC_KEY_SHA256 --checkpoint retained-checkpoint.json
python -m tgwitness.verify profiles-operations.json --fingerprint TRUSTED_PUBLIC_KEY_SHA256 --evidence evidence.zip
python -m tgwitness.verify history-channel.zip --fingerprint TRUSTED_PUBLIC_KEY_SHA256

Retain the actual verification results and original artifacts. The top-level case directory, source register and analyst conclusions are maintained externally; each TgWitness artifact has its own signature and verification procedure.

Adapt the investigation#

Collection reference · People-profile verification · Evidence handoff · Completed validation