
Forensic Analysis of Telegram Messenger on Android Smartphones [pdf] - lainon
http://people.unipmn.it/sguazt/pubs/Anglano-2017-Telegram.pdf
======
basicplus2
<we are able (a) to identify all the artifacts generated by Telegram
Messenger, (b) to decode and interpret each one of them, and (c) to correlate
them in order to infer various types of information that cannot be obtained by
considering each one of them in isolation.

As a result, in this paper we show how to reconstruct the list of contacts,
the chronology and contents of the messages that have been exchanged by users,
as well as the contents of files that have been sent or received.

Furthermore, we show how to determine significant properties of the various
chats, groups, and channels in which the user has been involved (e.g., the
identifier of the creator, the date of creation, the date of joining, etc.).

Finally, we show how to reconstruct the log of the voice calls made or
received by the user.

Although in this paper we focus on Telegram Messenger, our methodology can be
applied to the forensic analysis of any application running on the Android
platform.>

