Recovering Deleted Messages in Telegram

[Man]

Introduction​

Telegram is quite responsible about the privacy of its users. In particular, you can delete any message in the correspondence, both for yourself and for your interlocutor. And the message will indeed be deleted, for both and forever. But there are a couple of "buts".

If the message was written not too long ago, then most likely there is a local copy of it on the interlocutor's device. So:

First. In order for the message to be deleted from the interlocutor's device, he must open Telegram with the Internet turned on. Only then will the chats be synchronized, and the message will be deleted from the database on the device.

Secondly, even if the message has already been deleted, there is still a small chance of restoring it. Although this will require root on Android devices and jailbreak on iOS devices.

The chance of recovery will be close to 100% if:
a) you deleted the message from your device yourself,
b) immediately closed Telegram and did not open it again,
c) turned off the Internet.

Because every newly received message (from any chat, including a muted one) can take the place of the deleted one.

Total.

If you want to delete a message more reliably, do it in advance and let new messages completely erase the deleted ones on your device. And get your interlocutor online too.

If you want to restore a message that could have been deleted without your knowledge, on the contrary, do not allow data synchronization, turn off the Internet as soon as possible. And if you still can’t find the message in the application itself, get ready to hack your own device (if it’s worth it in your case, of course).

Practice​

I won't describe how to root or jailbreak. But if you just want to practice "on cats" (like me), then instead of a real device you can use an emulator from Android Studio. Emulators have root by default and, accordingly, provide access to the entire file system.

In Android Studio, create and run the emulator, install Telegram on it. Open the Device Explorer tab in the studio and go to /data/data/org.telegram.messenger.web/ (the name may differ slightly depending on your version of Telegram). Look for a regular SQLIite database with the extension ".db" (in my case, it was the file "cache4.db" in the subfolder "files") and save it to yourself.

Then you can go different ways. If you just need to view the database in a visual form, then you should use a DB viewer, like DB Browser for QSLite. If you need to restore messages, then you can use special utilities or a simple text editor. Recovery utilities (I tried about a dozen) are practically useless today. Perhaps they successfully restored something on old SQLite databases, but not on modern ones. So all that remains is to manually parse the text.

To open a database as text, you can use any editor. The main thing is that it can open the file as text in UTF-8 encoding. You can do this via Notepad++ (after opening, select Encodings > UTF8 ). Or via the banal Microsoft Word (immediately upon opening the db file, select Other > Unicode (UTF-8) ). Most of the text will still remain gibberish, but native speech can already be found in it. If you remember some keywords of the desired message, use the search. If the message was deleted, but has not yet been overwritten with something new, you will find it.

The message just deleted from the database is still inside the file

If you are just interested in seeing how Telegram stores your data, you should open the database in the DB Browser. Having opened our file in DB Browser, in the "Data" tab you can select the "messages_v2" table and search for messages in it. The text of each message is stored in the "data" column. In DB Browser, you can open it by selecting a cell and selecting the ">>" button in the "Edit DB cell" panel (on the right), then "Open in external application". Next, do not forget about the encoding.

Messages from a specific user can be found in the table by the "uid" field. The user ID can be found either through Telegram Desktop or on web.telegram.org. In the web version, the user's uid will be visible in the address bar if you simply open a chat with them. In the PC version, you need to go to Settings > Advanced settings > Experimental settings > Show Peer IDs in Profile , then open the profile of the desired user.

Conclusion​

Obviously, this article does not cover any fundamental topics and is only a description of personal experience on a rather specific issue. However, I was unable to find publications that would cover this topic in such detail and specifically. Perhaps, the article may be useful in some life situations for a wide range of people. And it will also be entertaining and instructive for those who rely too much on messenger tools in matters of security.

Source