Telegram Desktop

[clementepaixao]

I'm working on several recent cases where CSAM artifacts from Telegram Desktop appear in the Telegram in-app search, but IPED is unable to decode the corresponding files.
IPED lists many small files with no extension and no identifiable type inside the application directory.

From an initial research, it looks like that only media files are actually stored on disk, while conversations remain online only and in memory.

For comparison, I processed one of the cases in Magnet Axiom, which was able to successfully decode the Telegram images. The directory contained approximately 2 GB, 42k files, and about 20k images were decoded by Axiom.

[wladimirleite]

Hi @clementepaixao!
Currently, there is no support for Telegram Desktop artifacts.
Can you share the whole directory privately, so I can take a closer look and see if we can add this feature?

[patrickdalla]

hi clemente. I worked in a case with telegram desktop also that the fastest approach was the use of axiom. Afaik/remember, the images are encrypted, and not simply encoded. but the key can be found somewhere (axiom knows where). Our ex work coleague atila made a tool a long ago, https://github.com/atilaromero/telegram-desktop-decrypt, but it needs to be updated.

[clementepaixao]

Hi @clementepaixao! Currently, there is no support for Telegram Desktop artifacts. Can you share the whole directory privately, so I can take a closer look and see if we can add this feature?

Sent, @wladimirleite !