Media Cache

Overview

The Telegram Desktop media cache is the most forensically accessible artifact in a Telegram installation. When a user views or downloads photos, videos, voice messages, documents, or stickers in Telegram, the application writes these files to cache directories within tdata/user_data/. Unlike the rest of the tdata/ hierarchy — which is TDF$ encrypted and unreadable without the user's credentials — the cached media files are typically stored in their native binary format, directly readable with standard forensic tools.

This makes the media cache the primary source of message content evidence in a Telegram Desktop investigation. Even when TDF$ decryption is unavailable, an investigator can recover the photos and documents that a user received or sent, analyze their content, and use their timestamps to build a timeline.

Cache files have opaque hex-string filenames (e.g., a3f4b2c1d0e5f6a7) with no extensions. MIME type and media classification must be inferred from the file's magic bytes. macfor detects content type using the first 512 bytes of each file with Go's net/http.DetectContentType.

Cache Directory Locations

Primary Account (Account 1)

Additional Accounts

Telegram Desktop's multi-account support uses user_data#N/ directories for accounts 2 and 3 (and potentially beyond):

macfor checks all of these directories during collection.

Cache File Format

Because filenames are opaque, the only way to determine what a cached file contains is to examine its content. Magic bytes at the start of the file identify the format.

MIME Type Detection

macfor reads the first 512 bytes of each cache file and passes them to net/http.DetectContentType to infer the MIME type. The detected MIME type is then used to classify the media into a category:

Media Cache Record Fields

Each file in the media cache produces a telegram_media_cache record with the following fields:

Example records:

{
  "file_path": "/Users/alice/Library/Application Support/Telegram Desktop/tdata/user_data/cache/a3f4b2c1d0e5f6a7",
  "file_name": "a3f4b2c1d0e5f6a7",
  "mime_type": "image/jpeg",
  "size": 142688,
  "mod_time": "2025-11-02T14:37:22Z",
  "media_type": "photo",
  "user": "alice",
  "variant": "standalone"
}

{
  "file_path": "/Users/alice/Library/Application Support/Telegram Desktop/tdata/user_data/cache/b8e2d4f1a7c3e059",
  "file_name": "b8e2d4f1a7c3e059",
  "mime_type": "application/pdf",
  "size": 2097152,
  "mod_time": "2025-10-29T09:12:44Z",
  "media_type": "document",
  "user": "alice",
  "variant": "standalone"
}

{
  "file_path": "/Users/alice/Library/Application Support/Telegram Desktop/tdata/user_data/cache/d9f1c3e2a4b5d6e7",
  "file_name": "d9f1c3e2a4b5d6e7",
  "mime_type": "application/octet-stream",
  "size": 157286400,
  "mod_time": "2025-11-10T18:05:31Z",
  "media_type": "unknown",
  "user": "alice",
  "variant": "standalone",
  "skipped": true,
  "skip_reason": "exceeds 100 MB limit"
}

Size Limits and Collection Options

Media caches can grow very large. A user who has actively used Telegram for months may accumulate gigabytes of cached media. macfor enforces a configurable file size limit during media collection:

Files that exceed the size limit are not copied into the evidence container, but a telegram_media_cache record is still emitted with skipped: true and the file path, size, and timestamps. This ensures the investigator knows large files exist even if they were not collected.

To collect all media regardless of size:

macfor-pro collect --plugin messaging.telegram \
  --option max_media_file_size_mb=-1 \
  --output ./evidence.zip

To skip media cache entirely (for a fast metadata-only collection):

macfor-pro collect --plugin messaging.telegram \
  --option skip_media_cache=true \
  --output ./evidence.zip

Evidence Container Layout

Collected media files are stored in the evidence container under:

artifacts/messaging.telegram/files/{username}/{variant}/

The directory structure mirrors the original path relative to the cache directory. Original filenames are preserved.

Forensic Analysis Notes

Timestamp significance: The modification timestamp on a cached media file records approximately when the file was last written to disk by Telegram Desktop. For received media, this approximates when the user viewed or downloaded the item. For photos taken and sent via Telegram, the modification time reflects when the file was written to cache — which may be after the send event.

Cache eviction: Telegram Desktop evicts old cache files when the cache exceeds internal size thresholds. Older files are deleted first. An absence of cached media does not prove no media was received — only that Telegram's cache manager has evicted it. The presence of cached media files proves the user was active on Telegram during the period covered by those timestamps.

Sticker and animated content: Sticker packs are cached as individual image or animation files. Large numbers of sticker files in the cache indicate active use of sticker packs, which are a Telegram-specific feature.

Document evidence: When a user receives a document (PDF, archive, executable) via Telegram, the file is cached in the media cache before or instead of the user's Downloads folder. Cached documents with suspicious MIME types (executables, archives, scripts) are of particular interest in malware delivery and data exfiltration investigations.

Voice messages: Voice messages appear as audio/ogg files (Telegram uses OGG/Opus encoding). Their presence indicates voice communication occurred on the device.

Cross-referencing with other artifacts: The modification timestamps on media cache files can be correlated with:

• Apple Messages or Mail timestamps for the same time period
• KnowledgeC application usage events for Telegram Desktop
• FSEvents entries recording file creation in the cache directories

macfor Collection

The media cache is collected by default as part of the messaging.telegram plugin.

# Default collection includes media cache
macfor-pro collect --plugin messaging.telegram --output ./evidence.zip

# Collect with no size limit
macfor-pro collect --plugin messaging.telegram \
  --option max_media_file_size_mb=-1 \
  --output ./evidence.zip

# Skip media cache for a faster metadata-only run
macfor-pro collect --plugin messaging.telegram \
  --option skip_media_cache=true \
  --output ./evidence.zip

References

• Telegram Desktop tdata Format — tdesktop source
• Telegram Desktop Forensics — SANS DFIR Blog
• macOS Application Sandbox — Apple Developer Documentation