Recovering deleted messages in Telegram

Introduction

Telegram takes user privacy quite seriously. In particular, you can delete any message in correspondence, both from yourself and from your interlocutor. And the message will really be deleted, for both of them, forever. But there are a couple of “buts”.

If the message was written not too long ago, then most likely there is a local copy of it on the interlocutor’s device. So:

Firstly. In order for the message to be deleted from the interlocutor’s device, he must open Telegram with the Internet turned on. Only then will the chats be synced and the message will be deleted from the database on the device.

Secondly. Even if the message has already been deleted, there is still a small chance of its recovery. Although this will require root on Android devices and jailbreak on iOS devices.

The chance of recovery will be close to 100% if:
a) you yourself deleted the message from your device,
b) immediately closed the telegram and did not open it again,
c) turned off the Internet.

Because every newly received message (from any chat, including a muted one) can be overwritten in place of the deleted one.

Total.

If you want to delete a message more reliably, do it in advance and allow new messages to completely overwrite the deleted ones on your device. And get your interlocutor online too.

If you want to restore a message that may have been deleted without your knowledge, on the contrary, do not allow data to be synchronized and turn off the Internet as quickly as possible. And, if you still can’t find the message in the application itself, get ready to hack your own device (if in your case it’s worth it, of course).

Practice

I won’t describe how to root or jailbreak. But if you just want to practice “on cats” (like me), then instead of a real device, you can use the emulator from Android Studio. Emulators have root by default and, accordingly, give access to the entire file system.

In Android Studio we create and launch an emulator, install Telegram on it. Open the Device Explorer tab in the studio and go to /data/data/org.telegram.messenger.web/ (the name may be slightly different depending on your version of telegram). We look there for a regular SQLIite database with the extension “.db” (in my case it was the file “cache4.db” in the “files” subfolder) and save it to ourselves.

Then you can go in different ways. If you just need to view the database in a visual form, then you should use a database viewer, like DB Browser for QSLite. If you need to restore messages, you can use special utilities or a simple text editor. Recovery utilities (I've tried a dozen) are virtually useless today. They may have successfully restored something on older versions of SQLite databases, but not on modern ones. So all that remains is to manually parse the text.

To open the database as text, you can use any editor. The main thing is that it can open the file as text in UTF-8 encoding. You can do this via Notepad++ (after opening, select Encodings > UTF8). Or through the banal Microsoft Word (immediately when opening the db file, select Other > Unicode (UTF-8)). Most of the text will still remain gibberish, but native speech can already be found in it. If you remember some keywords of the desired message, use the search. If the message was deleted, but has not yet been overwritten with something new, you will find it.

If you are interested in just seeing how Telegram stores your data, you should open the database in the database viewer. Having opened our file in DB Browser, in the “Data” tab you can select the “messages_v2” table and search for messages in it. The text of each message is stored in the “data” column. In DB Browser, you can open it by selecting the cell and selecting the “>>” button in the “Edit DB Cell” panel (on the right), then “Open in external application”. Next, don’t forget about encoding.

Messages from a specific user can be found in the table using the “uid” field. The user ID can be found either through Telegram Desktop or at web.telegram.org. In the web version, the user's uid will be visible in the address bar if you simply open a chat with him. In the PC version you need to go to Settings > Advanced Settings > Experimental Settings > Show Peer IDs in Profilethen open the profile of the desired user.

Conclusion

Obviously, this article does not reveal any fundamental topics and is only a description of personal experience on a rather specific issue. However, I was unable to find publications that would cover this topic in as much detail and specifically. Perhaps the article may be useful in some life situations for a wide range of people. It will also be entertaining and instructive for those who rely too much on messenger tools for security issues.