ElcomSoft has updated Elcomsoft Phone Viewer, the company’s forensic extraction tool. Version 5.0 gains the ability to display conversation histories and secret chats in Telegram, one of the world’s most popular instant messaging apps.
With nearly half a billion users, Telegram is a popular cross-platform instant messaging app. While Telegram is not considered the most secure instant messaging app (this title belongs to Signal), its conversation histories don’t appear in either iTunes or iCloud backups.
Telegram developers emphasize end-to-end encryption for secret chats, which makes secret chats device specific. They’re not part of the Telegram cloud, they can’t be extracted with cloud acquisition, and they can’t be obtained from Telegram the company with a government request. As a result, Telegram secret chats can be only extracted from the device of origin.
Elcomsoft Phone Viewer 5.0 gains the ability to display Telegram conversations by analyzing the iPhone file system image. The Telegram database is extracted from a file system image obtained with Elcomsoft iOS Forensic Toolkit or similar tool. Experts using Elcomsoft iOS Forensic Toolkit will open the file system image in Elcomsoft Phone Viewer to access the Telegram database complete with attachments and secret chats.
In addition, Elcomsoft Phone Viewer 5.0 enables support for the latest version of the Signal instant messenger. The tool offers the ability to decrypt Signal conversation databases extracted from the iPhone file system images, obtained with Elcomsoft iOS Forensic Toolkit, and display its content including messages, calls and attachments.
The standard edition of Elcomsoft Phone Viewer costs US$79, and the forensic version is $399. The utility runs on both macOS and Windows.
