What is TgWitness?
TgWitness collects Telegram conversations accessible to connected accounts for OSINT and digital-forensics investigations. It preserves delivered messages, observed edits, deletion notices and optional attachments in a signed, append-only journal. Its interface supports reviewing saved versions, searching conversations and tracing connections back to recorded observations.
The application runs on an operator's computer or server with a bundled web interface. Windows, macOS and Linux launchers and Docker Compose deployment are documented. Each account has a separate workspace, session, journal, signing key and collection policy. Scoped access tokens allow reviewers to inspect selected workspaces or chats without receiving Telegram authorization.
Exports combine signed records, preserved files, an offline HTML report and a standalone verifier. Verification establishes integrity relative to an independently trusted key and retained checkpoints, not Telegram origin or complete capture. TgWitness cannot recover unseen deleted messages or Secret Chats, and interruptions can leave permanent gaps.
The project is published under the MIT License and installs with a single shell command on Linux and macOS.
TgWitness screenshots
Explore the interface. Open a screenshot to view it at full size.
Source: official TgWitness project page.
Key capabilities
- Observation journal Records delivered messages, edits, deletion notices, reactions, membership events and collection gaps from selected sources.
- Version preservation Keeps previously captured content after deletion notices and displays observed edits as separate versions.
- Signed exports Packages journal records, attachments, readable reports and a standalone verifier for independent integrity checks.
- Investigation review Searches saved conversations and supports source-linked timelines, people profiles, bookmarks and case notes within a workspace.
- Scoped collaboration Restricts reviewer access by workspace, chat, permitted action, expiry and IP address.
- Archive connections Provides read-only MCP access, optional local OCR and transcription, and scoped outgoing webhooks with HMAC signatures.
Where TgWitness fits
TgWitness fits investigations that require ongoing observation of accessible Telegram channels, groups, bots or private conversations, followed by a reviewable handoff. Analysts can preserve changes as they arrive, examine relationships within saved conversations and prepare focused reports while keeping analytical notes separate from original observations. Correlation across account workspaces and a combined timeline remain analyst work.
Before deployment, operators should verify source access, collection scope, attachment storage, backup procedures and access permissions. A controlled send, edit and delete test can establish which events reach the collecting account. The project advises using a dedicated account because Telegram may restrict or ban it. Recipients should obtain the signing-key fingerprint and relevant checkpoints independently of the exported archive.
Install
curl -fsSL https://get.destroy.tools/install.sh | bashReviews of TgWitness
Be the first to share your experience with TgWitness.
Write a review
Loading review form…
Alternatives to TgWitness
God's Eye ViewGod's Eye View combines public aircraft, satellite, earthquake and camera feeds in a Cesium globe. Run it locally, inspect each data source, add optional voice control and connect agents through MCP.SSherlockSherlock searches social networks for accounts matching supplied usernames. It runs from the command line, supports local installation or Docker, and exports findings for further review.