Telegram Desktop

Overview

Telegram Desktop stores its data in a proprietary TDF (Telegram Data Format) binary store under tdata/. Most of these files are encrypted, and an optional local passcode protects the key. macfor inventories tdata/: accounts, sessions, media cache, secret-chat traces, and crash logs. It records file presence, size, timestamps, and TDF$ headers, and can preserve the raw files (opt-in). It does not decrypt or parse message content.

Analysis Tips

• Local passcode: Set in Telegram → Settings → Privacy → Local Passcode. If enabled, the tdata store is encrypted with a key derived from this passcode
• Account directories: Subdirectories like D877F783D5D3EF8C/ (16 hex chars) correspond to logged-in accounts. Multiple accounts == multiple subdirs
• Map files: The map0 / map1 files index chunks holding message data. They are preserved raw, not parsed
• Cached media: user_data*/media_cache/ holds files Telegram has downloaded — a quick win for reviewers
• Two install locations: The Mac App Store build lives under ~/Library/Containers/ru.keepcoder.Telegram/. macfor checks both
• Cloud chats vs Secret chats: Secret chats are end-to-end encrypted and tied to the device; messages won't sync to other Telegram clients

Related Artifacts

• Signal Desktop - Compare against another encrypted-messenger artifact
• WhatsApp Desktop - Adjacent messaging artifact
• FSEvents - Cache writes show recent message and media activity

References

• Telegram Desktop source
• Telegram TDF reverse-engineering notes