Sessions and Secret Chats

Overview

Telegram Desktop session artifacts are the TDF$ encrypted files that authenticate the application to Telegram's servers and persist login state across restarts. While their contents are not readable without decryption, the presence, absence, and timestamps of session key files provide significant forensic information: whether an account is currently logged in, when the session was last renewed, and which account indices are active.

Secret chats in Telegram are end-to-end encrypted conversations that are specifically designed to leave no server-side record. They are initiated with a key exchange that generates a shared encryption key stored only on the participating devices. On macOS, this key exchange leaves behind trace files in the tdata/ directory. These trace files cannot be decrypted without the original key material, but their presence proves that the user participated in secret chats — a significant behavioral indicator in investigations involving covert communication.

Crash logs and diagnostic reports complement these artifacts by providing a timeline of application crashes, version information, and evidence of Telegram Desktop's operational history on the device.

Session Key Files

File Locations

Both files use the TDF$ binary format. Their contents are encrypted and cannot be read without the account's encryption key material.

Session Status Detection

macfor infers session status from file presence without decryption:

The key_datas naming convention (with trailing s) is Telegram's internal notation for a "safe copy" written during a session renewal operation. When both files coexist, the key_datas modification timestamp records the most recent renewal event.

Session Record Fields

Each session key file produces a telegram_sessions record:

Example record (active primary account):

{
  "key_file": "key_data",
  "size": 824,
  "mod_time": "2025-10-15T11:42:07Z",
  "is_tdf_encrypted": true,
  "tdf_version": 2008012,
  "status": "active",
  "account_index": 1,
  "user": "alice",
  "variant": "standalone"
}

Example record (renewed session — both files present):

{
  "key_file": "key_datas",
  "size": 824,
  "mod_time": "2025-11-18T08:31:55Z",
  "is_tdf_encrypted": true,
  "tdf_version": 2008012,
  "status": "renewed",
  "account_index": 1,
  "user": "alice",
  "variant": "standalone"
}

Two-Factor Authentication Indicators

macfor checks for the presence of 2FA configuration files in the tdata/ root:

These files do not confirm whether 2FA is currently active — only that it was configured at some point while Telegram was installed on this device. Their presence is logged during session collection.

Secret Chat Traces

What Secret Chats Leave Behind

Telegram's secret chats are end-to-end encrypted conversations that do not sync to Telegram's servers. When a secret chat is initiated, Telegram Desktop stores the key exchange data and session state in the tdata/ directory. These files are TDF$ encrypted — the actual conversation keys and content cannot be read — but their existence proves the user engaged in secret chat activity.

The secret_* files hold the key material for active secret chats. The map* files contain a mapping of secret chat sessions. Either type of file proves the device was a participant in end-to-end encrypted Telegram conversations.

Secret Chat Trace Record Fields

Each detected trace file produces a telegram_secret_chat_traces record:

Example record:

{
  "file_path": "secret_0a1b2c3d",
  "size": 2048,
  "mod_time": "2025-09-22T16:14:39Z",
  "is_tdf_encrypted": true,
  "tdf_version": 2008012,
  "trace_type": "key_exchange",
  "user": "alice",
  "variant": "standalone"
}

Account Identification Records

In addition to session key files, macfor collects account identification records that aggregate the key identity artifacts for each account:

The file_created timestamp is the most forensically significant: it records the earliest creation time across the usertag, key_data, and account directory, approximating when this account was first logged into Telegram Desktop on this macOS device.

Crash Logs and Diagnostic Reports

Collection Locations

Telegram Desktop crash logs are collected from three locations:

The user-level DiagnosticReports/ directory is always scanned. The system-level directory is only scanned when macfor is running as root. tdata/dumps/ is scanned for all detected Telegram installations.

Crash Log Record Fields

Each crash log file produces a crash_logs record:

Example record:

{
  "file_path": "/Users/alice/Library/Logs/DiagnosticReports/Telegram-2025-10-14-143022.crash",
  "file_name": "Telegram-2025-10-14-143022.crash",
  "size": 48192,
  "mod_time": "2025-10-14T14:30:22Z",
  "report_type": "crash",
  "user": "alice"
}

Crash Log Forensic Value

• Crash timestamps: The filename of a .crash or .ips file typically includes the crash date and time. The modification timestamp on the file confirms when the crash occurred.
• Version identification: Crash reports contain the Telegram Desktop version number in their text content. This can help correlate the artifact with a specific version of Telegram Desktop.
• Application timeline: A series of crash logs establishes that Telegram Desktop was actively running during specific periods.
• tdata/dumps files: Crash dump files written directly by Telegram Desktop may contain more detailed internal state than the macOS-generated crash reports.

Collection Options

Crash log collection is always enabled and cannot be individually disabled. Account identification is always collected.

# Default collection (all session artifacts)
macfor-pro collect --plugin messaging.telegram --output ./evidence.zip

# Skip sessions and secret chat traces
macfor-pro collect --plugin messaging.telegram \
  --option skip_sessions=true \
  --option skip_secret_chat_traces=true \
  --output ./evidence.zip

Forensic Analysis Notes

Account first-login dating: The file_created field in account records represents the earliest creation timestamp across usertag, key_data, and the account directory. On APFS volumes, where birth times are reliably preserved, this timestamp closely approximates the first time this Telegram account was authenticated on the macOS device.

Logout detection: A tdata/ directory that contains settings* files but lacks key_data and key_datas indicates the account was explicitly logged out. Telegram deletes session key files on logout but leaves settings files in place. The modification time of settings0 or settings1 may record when the logout occurred.

Multi-account behavioral patterns: The combination of multiple account directories (tdata/#2/, etc.) with different file_created timestamps indicates the user added additional Telegram accounts over time. The timestamps can establish a sequence: which account was added first, and whether accounts were added around specific dates relevant to the investigation.

Secret chat file count: The number of secret_* files indicates the number of active secret chat sessions that existed at collection time. Multiple files suggest multiple simultaneous secret conversations. Note that Telegram removes secret chat files when a secret chat is explicitly deleted or the key expires.

Renewal events as security indicators: A key_datas file with a recent modification timestamp — particularly one that coincides with other suspicious activity — may indicate a new device login or a forced re-authentication event. Telegram triggers session renewal when a new device joins the account or when certain security thresholds are crossed.

References

• Telegram Secret Chats — Telegram Documentation
• Telegram Desktop Source Code — telegramdesktop/tdesktop
• macOS Diagnostic Reports — Apple Developer Documentation
• Forensic Analysis of Telegram Desktop — SANS DFIR