Although the self destruction options make sure messages are deleted from the phone, there will be some traces left in the raw data of the database. If we open the tgdata_index.db in a Hex-editor or in this case in Encase Forensic, we can see some parts of the messages that are “self destructed” can still be found. Notice that some of the words miss the first letter.