REVISTA DYNA NEW TECHNOLOGIES

Key words:

Telegram, forensic, digital evidence, expert witness report, export

Article type:

ARTICULO DE INVESTIGACION / RESEARCH ARTICLE

Section:

RESEARCH ARTICLES

ABSTRACT:
Not long ago, it was common to see printed copies of digital evidence submitted in legal proceedings. Obviously, these printouts were not accompanied by any technical support to verify their authenticity. However, in recent years, this aspect of judicial processes has changed, with lawyers now requesting that all evidence be submitted along with an expert report that guarantees its authenticity and extraction process. In this article, we analyze the forensic process of extracting evidence from the Telegram messaging service. Chat applications are increasingly being used in criminal activities, such as the distribution of illegal or protected contents or the exfiltration of data in corporate environments. Although Telegram is not as popular as WhatsApp, its appearance in legal proceedings is becoming more frequent-especially since it has also become a means of accessing information. The aim of the article is to examine whether Telegram's own export tool provides sufficient information or if it is necessary to use additional techniques, such as accessing its main database. This is very relevant for processes in which an expert has access to the device where the conversation resides, as it would greatly facilitate the forensic work (timeframes, technical complexity and, ultimately, cost for the client).The results of the study indicate that database analyses provides little additional information beyond what may be obtained through the application's export system, with one exception: secret chats. The JSON export is truly comprehensive and provides all kinds of details. In cases where secret chat analysis is relevant, database extraction and analysis are currently the only option.

Keywords: Telegram, forensic, digital evidence, expert witness report, export