TgWitness: Telegram Export, OSINT & Verification

TgWitness is an open-source Telegram exporter and investigation workspace. Install it with one command, connect an account, choose the chats and export a signed archive. It also supports temporary collection on GitHub Actions and continuing investigations with saved edits, deletion observations, search and reports.

Start with the task you have#

One-command installation#

The installer includes Python and dependencies. A source checkout, Docker, an AI provider and an independent witness are optional choices, not setup prerequisites.

Linux / macOS:

curl -fsSL https://get.destroy.tools/install.sh | bash

Windows, in PowerShell or Command Prompt:

powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "irm https://get.destroy.tools/install.ps1 | iex"

Open the panel, connect your Telegram account and select the collection scope. Installation does not start collection by itself. The installation guide explains local access, servers, updates and checking the downloaded build.

For a temporary runner, follow GitHub Actions capture. That workflow needs a GitHub fork, authorization and an archive password. The capture page explains those steps and the session time budget before the run. Download and retain the resulting archive and its verification material.

More settings when the task needs them#

A single-chat export needs an account and a selected scope. Continuing observation, multiple accounts, proxies, attachment policies, report design, reviewer access, external timestamps and off-site storage serve different investigation and handoff requirements. Configure those features when they are relevant.

Scope, permissions and minimized sharing copies help operators choose what to collect and disclose. Jurisdiction guidance and report settings support that decision; selecting a profile does not itself establish legal compliance or admissibility. See account export, access and report configuration.

The application runs on the chosen computer or server. Basic collection does not require a GPU or an LLM. Optional OCR, transcription and AI analysis have their own resource requirements. Size a deployment for message rate, attachments, retained history and concurrent accounts; an easy installation is not a promise of a fixed memory footprint for every workload.

Preserve the record, whoever it helps#

The purpose is to preserve observed material, context and changes regardless of whose position they support. Evidence may challenge the collector's own account of events. Keep source observations, missing coverage and analytical conclusions identifiable so another person can assess the same material.

The logic is: account-visible observation → signed journal → export → recipient verification. Saved edits add versions. Deletion observations retain previously captured content. Coverage records expose known interruptions. Reports and AI analysis refer back to saved sources; an interpretation does not become a source observation merely because it appears in a signed report.

These checks support review of integrity and provenance. They do not turn the content of a message into a true statement or reconstruct unseen deleted messages. Use an independently obtained key fingerprint and the verification steps in the trust guide and evidence format.

Published scale and measured performance#

The following results describe different workloads and dates. Counts are not interchangeable: a journal event is not necessarily a unique Telegram message.

The verification record gives the server inventory, live collection checks and search measurement. Export performance publishes the two real runs, hardware, durations, archive hashes and signed measurement files. They establish results for their recorded revisions and conditions, not a universal rate or capacity ceiling.

Testing history and duration#

The maintainer reports more than six months of testing as of 6 November 2026. This describes the project's testing history. The dated public measurements above document individual runs; they do not establish an independently verified, uninterrupted six-month collection run. The age of exported messages is also different from the time the collector has been running.

Read capability status precisely#

Assess each workflow against its implementation, published build and recorded tests. The source is currently labelled preview. That release label coexists with working collection, exports, independent verification and published scale measurements. A preview feature and a validated workflow can exist in the same application; describe the specific feature and evidence behind an assessment.

Use current capabilities, features and limits, verification and the changelog together. Record the tested revision when citing a result. The 6 November measurement snapshot also retains failed and skipped tests; those are not passes.

Readable by people and AI tools#

The website provides a concise llms.txt, a complete English handbook in llms-full.txt and llms-full.md, and Markdown editions of its pages. These are documentation formats, not an AI requirement for running TgWitness.

Optional MCP and command-line access let authorized tools read selected saved records. Message content remains untrusted input. Summaries should cite sources, distinguish observed facts from inference and preserve uncertainty. Full-text search, OCR and AI output do not change the original signed observations.