Pro plugin

Telegram Desktop

Collects account data, media cache, sessions, and diagnostic artifacts from Telegram Desktop local storage (tdata)

messaging.telegramPromacOS 10.13+v1.0.0communicationusermessaging

Run this plugin

Trigger collection for Telegram Desktop on its own with the --plugin flag, or include it in a wider sweep by category.

# Just this plugin
macfor-pro collect --plugin messaging.telegram --output ./evidence.zip

# Dry run — list what would be collected
macfor-pro collect --plugin messaging.telegram --dry-run

Compatibility

macOS 10.13+

Licensing: ships in the macfor-pro binary. See Community vs Pro.

Artifacts collected (7)

Each row corresponds to an entry in the plugin's artifacts.yaml manifest. Optional artifacts are skipped unless explicitly enabled.

messaging

Artifact	Format	Path	Notes
Telegram Accounts telegram_accountsSensitivehigh value	binary	`~/Library/Application Support/Telegram Desktop/tdata/key_data` +1 more ~/Library/Containers/ru.keepcoder.Telegram/Data/Library/Application Support/Telegram Desktop/tdata/key_data	Account identification records from key_data and user_tag files.
Telegram Secret Chat Traces telegram_secret_chat_tracesSensitivehigh value	binary	`~/Library/Application Support/Telegram Desktop/tdata/user_data/` +1 more ~/Library/Containers/ru.keepcoder.Telegram/Data/Library/Application Support/Telegram Desktop/tdata/user_data/	Secret chat trace indicators from encrypted local files.

metadata

Artifact	Format	Path	Notes
Telegram tdata Manifest telegram_tdata_manifestmedium value	directory	`~/Library/Application Support/Telegram Desktop/tdata/` +1 more ~/Library/Containers/ru.keepcoder.Telegram/Data/Library/Application Support/Telegram Desktop/tdata/	Directory structure and file inventory with TDF$ header detection.
Telegram Raw Files telegram_rawOptionalOpt-in	binary	`~/Library/Application Support/Telegram Desktop/tdata/` +1 more ~/Library/Containers/ru.keepcoder.Telegram/Data/Library/Application Support/Telegram Desktop/tdata/	Raw tdata directory files for offline analysis.

media

Artifact	Format	Path	Notes
Telegram Media Cache telegram_media_cacheSensitivehigh value	binary	`~/Library/Application Support/Telegram Desktop/tdata/user_data/media_cache/` +1 more ~/Library/Containers/ru.keepcoder.Telegram/Data/Library/Application Support/Telegram Desktop/tdata/user_data/media_cache/	Cached media files including images, videos, documents, and voice messages.

credentials

Artifact	Format	Path	Notes
Telegram Sessions telegram_sessionsSensitivehigh value	binary	`~/Library/Application Support/Telegram Desktop/tdata/key_data` +1 more ~/Library/Containers/ru.keepcoder.Telegram/Data/Library/Application Support/Telegram Desktop/tdata/key_data	Session and authentication artifact records.

logs

Artifact	Format	Path	Notes
Telegram Crash Logs telegram_crash_logsmedium value	binary	`~/Library/Application Support/Telegram Desktop/tdata/dumps/` +2 more ~/Library/Containers/ru.keepcoder.Telegram/Data/Library/Application Support/Telegram Desktop/tdata/dumps/ ~/Library/Logs/DiagnosticReports/Telegram*	Crash logs and diagnostic reports from Telegram Desktop.