After extracting an iphone 5, we found a tgdata_index.db in a common iphone folderstructure. The tgdata_index.db was found in a subfolder “Documents”. The tgdata_index.db is a SQLite database and can be opened in a regular SQLite database viewer.

As one can see, the Telegram-messages are there to be found in clear text.


Ofcourse we can open this database in a SQLite database-viewer and we will see the textmessages in plain text. As shown here you can see there is 73 messages to be found in the database. The messages are, like we would expect, the non deleted messages.