Loading...
Contacts +1 800 529 10 37 aiero@mail.co
Follow us: Get in Touch
Get in Touch
Get in Touch

TGXTRACT Telegram extraction, review and reporting

View Windows download Request OSINTERSECT DB access
Telegram case work

Telegram evidence, kept in context

TGXTRACT is a local-first Telegram extraction, review, analysis and reporting tool for investigators, analysts and specialist teams who need to preserve source context from collection through to briefing and handover.

It brings collection, review, relationship analysis, evidence selection and export verification into one case workflow. The operator remains responsible for access, assessment and corroboration; TGXTRACT keeps the material organised and explainable.

See what you need before your first case
Getting started

Five steps from download to your first extraction

The complete path is shown here so an investigator can see what is required before beginning a case.

01 [ download ]

Get TGXTRACT

Download the current Windows installer from OSINTERSECT and confirm the published filename and SHA-256 value.

Official download
02 [ install ]

Install TGXTRACT

Run the signed Windows installer and follow the normal setup steps. No TGXTRACT licence or activation file is required.

The downloads page publishes the filename, SHA-256 value and release checks for the current installer.
03 [ connect ]

Prepare API details

Obtain the Telegram API ID and API hash that you are authorised to use. These establish the application connection.

API details are different from the Telegram account sessions used for collection.
04 [ authorise ]

Add credentials

Authorise one or more Telegram accounts using the verification code and, where enabled, the account's two-step password.

Compatible existing sessions can be imported as additional credentials.
05 [ investigate ]

Create the case

Add the Telegram target, choose the collection scope and start. TGXTRACT shows the active stage, progress and credential state.

See the case workflow
Telegram credentials

One works. More gives the queue more options.

This is capacity guidance, not a requirement to create multiple Telegram API applications.

One authorised credential is enough to use TGXTRACT and run a straightforward extraction.

  • Suitable for learning the workflow and smaller jobs.
  • All collection depends on that account's access and availability.
  • If it is busy, restricted or waiting, the queue has no alternative.

Three authorised credentials are a practical starting point for regular case work.

  • The queue has alternatives when one credential is busy or temporarily waiting.
  • Several targets and ordinary collection stages can be scheduled more smoothly.
  • It provides useful resilience without requiring a large account pool.

Five or more authorised credentials are better suited to larger, multi-target or media-heavy work.

  • More working lanes give the queue broader scheduling capacity.
  • Useful for member-heavy collection, substantial media retrieval and concurrent targets.
  • This remains operational guidance, not a hard minimum imposed by TGXTRACT.
Boundary: TGXTRACT does not provide Telegram accounts, bypass Telegram restrictions or turn enrichment into evidence. More credentials do not bypass access controls, target membership requirements, account restrictions, rate limits or flood waits.
Case workflow

One case workflow from collection to handover

View Windows download
Extraction
01 / Extract

Bring Telegram material into a structured case workspace.

Targets, messages, media, members, forwards and replies stay together so the case starts with a clear source trail.

Review
02 / Review

Work through messages, media and members without losing context.

The review workspace keeps source messages, attachments, extracted entities and user detail close enough for proper triage.

Canvas
03 / Canvas

Map relationships without turning every lead into a conclusion.

Canvas helps analysts inspect links between accounts, handles, phones, domains, IPs, media, messages and report evidence.

Report
04 / Report

Select evidence deliberately and keep connected context separate.

The report builder is there to help the investigator decide what belongs in the report, not to dump everything into an export.

Export
05 / Export

Create a package that can be checked, reviewed and handed over.

Manifests, hashes and export checks help a reviewer understand what was produced and whether it still matches the recorded output.

Operational safeguards

What stays local, what is excluded, and what still needs human judgement

TGXTRACT keeps credentials, source material, derived leads and final evidence in their proper places.

01

Case work remains local

Collection, Review, Canvas and Report are organised around the investigator's machine rather than a hosted case workspace.

02

Credentials stay separate

Telegram sessions are account-access material, not case evidence. Real credentials and session files are excluded from case archives, report exports and safe support summaries.

03

Leads remain leads

Location suggestions, username enrichment and OSINTERSECT results can direct attention. They are not proof of presence, ownership, identity or intent.

04

Handover can be checked

Selected evidence, supporting files, link-chart output, manifests and hashes remain together so another investigator can verify the output.

Operational safeguards
Local-first Case workspace
Protected Account access
Caveated External results
Verifiable Case handover

Keep the case local. Keep account access separate. Treat enrichment as leads. Hand over output another investigator can verify.

Free to download. No licence required.

TGXTRACT is a community tool for investigators, analysts and teams working with Telegram-heavy cases. The signed Windows installer is distributed directly through the official OSINTERSECT downloads page.

OSINTERSECT DB access is separate from TGXTRACT. Eligible official agencies can request controlled access for supported enrichment workflows, subject to verification and written agreement.

Download TGXTRACT Request OSINTERSECT DB access

Download TGXTRACT. Add OSINTERSECT DB access only when you need it.

01
Signed Windows download

Current installer, filename, SHA-256 value, digital-signature status and release checks.

Open downloads
02
OSINTERSECT DB access

Optional controlled enrichment access for eligible official agencies, subject to verification and written agreement.

Request DB access
03
Contribute

Testing, documentation, translation, deployment feedback, feature proposals and development support remain welcome.

Contact OSINTERSECT
Practical questions

What an investigator should know before starting

A Windows machine, the TGXTRACT installer, Telegram API details and at least one authorised Telegram account or compatible session. No TGXTRACT licence is required. Media-heavy cases also require sufficient local storage.

One works and is enough to begin. Three is a practical starting point for regular work. Five or more gives the queue more authorised options for larger, multi-target or media-heavy cases. More credentials do not bypass Telegram restrictions, access controls, rate limits or flood waits.

The Telegram API ID and API hash establish the application connection. A Telegram credential is an authorised account/session that TGXTRACT can use for collection. The working lanes come from authorised credentials, not from repeatedly creating API ID and API hash pairs.

No. The operator or organisation provides and authorises the Telegram accounts, sessions and API details that it is permitted to use.

No. Real Telegram credentials and session files are excluded from case archives, report exports and safe support summaries. Imported cases can retain inactive, redacted references so their collection history remains understandable without moving a usable account.

Not by themselves. External enrichment and suggested locations are investigative leads. They require assessment and corroboration before reliance and are not treated as proof of identity, ownership, presence or intent.

No. TGXTRACT can be downloaded and used without a licence or activation file. The official signed Windows installer is distributed through the OSINTERSECT downloads page. OSINTERSECT DB access is a separate controlled service and is not required to use TGXTRACT.

OSINTERSECT DB access is separate from TGXTRACT and is currently limited to eligible official agencies in the EU, EEA, UK and Ukraine. Requests must use an official organisational email address and are subject to verification and written agreement.
OSINTERSECT DB access

Request controlled OSINTERSECT DB access

TGXTRACT itself is freely downloadable and does not require a licence. Use this form only if your organisation needs controlled access to the OSINTERSECT DB for supported enrichment workflows.

Access is currently limited to eligible official agencies in the EU, EEA, UK and Ukraine. Requests must use an official organisational email address and are subject to verification and written agreement.

Official agencies EU · EEA · UK · Ukraine Verification + agreement

    Controlled access
    OSINTERSECT DB

    For eligible official agencies requesting access to supported OSINTERSECT DB enrichment workflows.

    EU / EEA / UK / Ukraine
    Official organisational email
    Verification + written agreement

    TGXTRACT itself does not require a licence. This form is only for OSINTERSECT DB access.