search

sepinf-inc / IPED

IPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by law enforcement or in a corporate investigation by private examiners.
Other
884 stars 209 forks source link

Improve Telegram Channels support on Android #2134

Closed wladimirleite closed 3 months ago

wladimirleite commented 3 months ago

Currently the Telegram parser shows groups and channels as groups. Sometimes it is important to distinguish, as there are specific behaviors.

In some channels, participants (or subscribers) are unknown, but in the database there is a number of participants stored, which could be extracted as a metadata. There is also a table that stores channels admins, which is also not extracted currently.

I am making some simple changes to clearly show if a chat is from a group or a channel. Currently there is a metadata named "Participants" (ExtraProperties.PARTICIPANTS).

@lfcnassif, I noticed that the existing "Participants" metadata does not have any defined prefix, and it receives the "html:" prefix (because it was set to the chat generated HTML, I guess) , which seems a bit odd to me. Wouldn't it make more sense use the "Communication:" prefix?

I would like to define two new ones: "ParticipantsCount" and "ChannelAdmins".

lfcnassif commented 3 months ago

Hi @wladimirleite!

Html: prefix is wrong, the intended behavior was to use no prefix. Using the Communication: prefix seems a good idea. Somewhat related, we also have the Message-Recipients Metadata for emails, maybe we could merge those 2 different Metadata...

lfcnassif commented 3 months ago

we also have the Message-Recipients Metadata for emails, maybe we could merge those 2 different Metadata...

Sorry, I've written in a hurry, those 2 properties are for different purposes: Participants is used to store all group members, Tika's Message-Recipient-Address is used to store just the recipients of a message.