Home

The investigation handbook

From the first captured message to an export someone else can check.

Explore the demo · Start your first case · How the record works · Project

From a chat to a case.

Export a chat · Investigate · Capture changes

Your first investigation

1. Connect a dedicated account
2. Pick sources and scope
3. Follow the records across chats
4. Export and verify

Quick sanity check: send a test message in a chat you control, edit it, delete it. You should see the message, a second version, and the content still there after the deletion. Then verify the export and keep the result with the test archive.

Pick your task

I want to…	Open
Try it and connect an account	Getting started → Accounts
Know what every screen does	Panel guide
Choose chats, keep changes	Collection and coverage
Save one chat for offline reading	Export one chat
Run several accounts as a group	Accounts
Investigate across chats	Investigations
Keep team notes	Case Board
Load history, use AI, connect tools	Archive and integrations
Hand over and verify	Exports and verification
Keep an independent checkpoint	Independent witness · Protection modes
Alerts, encrypted remote copy	Notifications · Off-site copy
Run on a server, recover	Server and Docker · Backup and recovery
Fix something, look up a term	Troubleshooting · FAQ · Glossary

Setup and advanced guides

Give others scoped access to chosen accounts and chats. Pick proxy routes and IP modes.

Connect & deploy	Preserve & verify	Find an answer
Proxies and connection routes	Independent witness	Troubleshooting
Servers and Docker	Backup and recovery	Frequently asked questions
Hardened deployment	S3 off-site copy	Glossary

Understand the evidence

The evidence model and formulas · Interactive explanation

Read this before connecting

Ethical Notice & Historical Continuity Read the complete author statement: our statement on Taylor Wessing PartG mbB — German core, Hamburg office.

TgWitness is MIT-licensed. Our position on Taylor Wessing is a statement, not a licence condition.

Use an account you can afford to lose. A session is full access to that account, so keep sessions, panel tokens and keys to yourself. Messages and files on disk aren't encrypted by TgWitness, use disk encryption.

Verify the signed archive with a key fingerprint and checkpoint kept elsewhere. It checks the saved records and files, and the archive reports the collection period and any gaps. Export and verify.

Project and help

Project overview · Complete project guide · Technical documentation · Verification record · Get help · Contribute · Report a vulnerability

Labels here follow the English interface and can drift between releases.