Alexis Brignoni
@abrignoni@infosec.exchange
Digital forensics nerd. Opinions are mine and subject to change. He/Him. #DFIR #DigitalForensics #FOSS #Python #OSDF #MobileForensics Whoami? 🖥 Developer of open-source tools for digital forensics (iLEAPP, ALEAPP, & RLEAPP.) 📱 Digital forensics examiner specializing in mobile forensics. 🔊 Public speaker on cybersecurity and digital investigations. 🃏 Certified Digital Forensics Memer
infosec.exchange
📱 New: Telegram support across both LEAPPs, plus a reference nobody had published.
Fifteen artifacts. Six for iOS in iLEAPP, nine for Android in ALEAPP, which had no Telegram support at all before this. Thanks Geraldine Blay for the questions that spurred all this research and development.
⚙️ The settings. Auto download stored per network type and per chat category, plus Save to Photos and Save to Gallery. These are what answer whether a photo ever reached the device gallery, which the message record cannot tell you.
⚠️ The warning that matters most: Telegram writes no settings record until the user changes something. No key in the database does not mean "off," it means the app default applied. A tool that prints "off" there is inventing evidence. Ours distinguishes the two states explicitly.
📖 The system events reference. The two clients name the same events differently, and only 27 of roughly 70 pair by name. So: 64 iOS types, 68 Android types, 62 paired, every row linking to the defining line in Telegram's own source, pinned to a commit. Printable PDF included.
Also documented: our own gaps. Five capabilities we could not validate against real data, listed in the post, with a request for research images.
Blogpost: leapps.org/blog-post?post=2026-08-04-telegram-ios-android-coverage
Telegram Events Reference Documentation: leapps.org/blog-post?post=2026-08-04-telegram-system-events-reference
#DFIR #DigitalForensics #MobileForensics #LEAPPs #ILEAPP #ALEAPP