Profile
Back to NewsBack
GitHub Trending 5 min
Reader Mode
phishdestroy/TgWitness: Open-source Telegram chat exporter, deleted & edited message logger, and OSINT forensics archiver. Save chat history, capture deleted messages, compare edit versions, and export signed HTML/JSON/CSV evidence.

phishdestroy/TgWitness: Open-source Telegram chat exporter, deleted & edited message logger, and OSINT forensics archiver. Save chat history, capture deleted messages, compare edit versions, and export signed HTML/JSON/CSV evidence.

4 hours ago

TgWitness — Follow the trail. Preserve the evidence. A captured message, its saved edit and a retained record.

Explore the interactive demo Download and start TgWitness Read the investigation handbook

Your Telegram investigation workspace.
Export chats, preserve observed changes and trace connections back to the source.
Self-hosted. Separate accounts. Signed handoffs.

v0.7.0 · pre-release Tested environments 25 interface languages · 26 guide languages MIT

OpenSSF Scorecard</a> Independent verification guide</a>

The TgWitness demo in motion: captured messages, saved versions and content retained after deletion. Fictional demonstration records.

Explore the actual interface with fictional records. Click the workspace to try it.

From a conversation to a case

Three animated workflows: export a chat to HTML and JSON, find a shared link across recorded chats, and retain captured versions after a deletion notice.

Chat export guide Investigation guide Collection and saved versions

Choose your scope: selected chats, a Telegram folder or the whole account. Keep each account in its own workspace, with separate sources, session and signing key.

Built for the rest of the investigation

Track names and usernames by Telegram ID. Record supported bot interactions with signed receipts. Search archived messages and connect read-only MCP clients. Deploy a collector with SSH masked and provider records for review. Illustrative workflows.

People and dossiers Bot investigation

Archive search, AI and MCP Sealed cloud deployment

Current source adds more: load the history of enabled chats with pause/resume, review sources before asking AI, connect read-only MCP clients, run local OCR or transcription, and send HMAC-signed webhooks. The 0.7.0 portable preview predates these additions; use main to try them.

Pick the tools for your case · history, accounts, media and integrations

| Task | What you get | | --- | --- | | Load older messages | Enabled sources → workspace history, with pause/resume and a signed progress report. | | Export with several accounts | Split one chat's acquisition across eligible accounts; each keeps its own session and signing key. | | Import a batch of accounts | Pair session files automatically, see each login result and organize workspaces into groups with shared settings. | | Manage the MTProxy pool | Ping, countries, filters and your own lists; one shared catalog with separate account routes. | | Bring an existing session | Telegram Desktop TData, Telethon, Pyrogram, StringSession or an auth key. | | Route through a proxy | Per-workspace SOCKS5, HTTP CONNECT or MTProxy. Hide IP mode refuses direct fallback. | | Search and review | Local search, optional AI, cited observations and separate analytical reports. | | Connect via MCP | Seven read-only tools, selected workspaces/chats, expiry and revocation. | | Read images and audio | Optional local OCR and transcription; original files stay unchanged. | | Send webhooks | Scoped outgoing events, HMAC signatures, retries and an n8n example. | | Share a focused view | Selected accounts/chats, permissions, expiry and IP restrictions. |

Your first capture

Windows portable: download TgWitness 0.7.0, extract it and run TgWitness.cmd. Python is included.

From source: download the source with Python 3.11+ installed. The launcher prepares the environment.

| | Windows | Linux / macOS | | --- | --- | --- | | Try the demo | scripts\Demo.cmd | sh start.sh --demo | | Connect Telegram | Start.cmd | sh start.sh |

Open http://127.0.0.1:8787. Use a separate Telegram account. Stop the demo before starting live mode; the live panel token is in data/live/panel-token.txt.

Setup guide Prepare your account Docker and servers

Export through GitHub Actions · preview

Run the pinned collector from your fork, select one chat and download an encrypted archive with GitHub provenance. The capture helper is also available under Exports in the panel.

Open the capture page · Instructions · Русский

A record someone else can check

Export the observations and preserved files together. Give the recipient an independently trusted key fingerprint and checkpoint to verify the handoff.

python -m tgwitness.verify evidence.zip --fingerprint TRUSTED_SHA256 --checkpoint checkpoint.json

Verification checks integrity against those trusted inputs. A local signing key alone does not prove Telegram origin or complete history.

Inside the signed record · hashes, signatures and independent checkpoints

New messages, saved edits and deletion observations form a linked, signed journal. Verify it against an independently trusted key.

Evidence format · Independent witness · External timestamps

Keep the investigation running · notifications, storage and recovery

Animated workflows: Apprise sends configured alerts; off-site copies are encrypted before upload to S3-compatible storage.

Notifications · Encrypted off-site copy · Backup and recovery · Troubleshooting

TgWitness can only collect what the connected account can access. It cannot recover unseen deleted messages or Secret Chats; downtime may leave gaps.

Technical documentation Investigation handbook Tested environments

⚖️ Ethical Notice & Historical Continuity

We have recently learned that for certain law firms—and specifically Dr. Tobias Schelinski and Dr. Patrick Vincent Zurheide—mathematics and objective facts are irrelevant.

Selling GDPR non-compliance to corporations as a commercial service while failing at basic data handling yourselves is not legal expertise.

Operating under the delusion that you are the law, or that an elite signature on a falsified claim magically turns a lie into truth, does not mask technical incompetence.

This tool is incompatible with jurisdictions where the following prevail:

  • Corporatocracy
  • Privatized or commercial justice
  • Plutocracy
  • Kleptocracy and institutional corruption
A special mention to Dr. Patrick Zurheide, Dr. Tobias Schelinski, and those attempting to weaponize the "Right to be Forgotten" to bury their own data-processing failures, sanitize their institutional lineage, and erase the historical record:
Taylor Wessing (Dr. Tobias Schelinski & Dr. Patrick Vincent Zurheide) → Wessing & Berenberg-Gossler → Stonewall Top 100 → Dr. Graf von der Goltz Dr. Wessing & Partner (since 1957) → Rüdiger Graf von der Goltz → Paragraph 175 in its 1935 revision

To strictly comply with the MIT License, we do not restrict the use of this software. However, let it be clear: corporate retainers, legal intimidation, and demands for digital erasure cannot override history, rewrite lineage, or conceal the truth.

Source record

MIT License · Technical notice · Original NOTICE

Repository map — source, deployment and contribution guides

| Directory | Contents | | --- | --- | | tgwitness/ | Application, collector, journal, verifier and web panel | | docs/ | Guides, Wiki source, screenshots and verification record | | deploy/ | Compose configurations and service templates | | scripts/ | Demo, setup and Docker launchers | | tools/ | Builds, checks and packaging | | website/ | Documentation website and translations | | .github/ | Workflows and contribution guides |

Complete project guide · Technical documentation

Read the project overview in your language

English · Русский · Українська · Español · Português (Brasil) · Türkçe · العربية · فارسی · اردو · हिन्दी · Bahasa Indonesia · Tiếng Việt · 简体中文

Built by PhishDestroy Contribute Get help Report a vulnerability

Chat with me