search

sepinf-inc / IPED

IPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by law enforcement or in a corporate investigation by private examiners.
Other
893 stars 213 forks source link

Telegram parser missing messages #1976

Closed lfcnassif closed 4 months ago

lfcnassif commented 8 months ago

Reported by a colleague. Just a hyphen is printed as message, mixed with normal messages in the same chat. Not sure if it is a bug or caused by some change in recent Telegram versions.

lfcnassif commented 8 months ago

Thanks @hauck-jvsh for your availability to take a look.

wladimirleite commented 7 months ago

@lfcnassif / @hauck-jvsh, in this case, do you know if the messages shown as hyphens are displayed correctly in PA?

I am working on a case with Telegram for Android, and there are a lot of these "-" messages, but they are shown by PA as empty messages. I checked a few of these "empty" messages, and they were messages that sent some media (image or video) without any text. So the messages were actually empty. In IPED Telegram parser, format() is called for each message in out.print(format(message.getData()));, which transforms empty messages in "-", which may be a bit misleading (probably for messages the empty string should be kept).

lfcnassif commented 7 months ago

@lfcnassif / @hauck-jvsh, in this case, do you know if the messages shown as hyphens are displayed correctly in PA?

Hi @wladimirleite. No, our colleague said they didn't show up in PA. He said he saw the messages in the phone screen, but the phone is not here anymore and I'm not able to verify what he said...

probably for messages the empty string should be kept

I agree.

wladimirleite commented 7 months ago

Unfortunately I don't have the device with me neither, but I will try to check it on the next one with Telegram chats.

lfcnassif commented 4 months ago

Closing as can't reproduce, since the user doesn't have the device anymore. We can reopen later if this is confirmed.