Answering myself; https://medium.com/@elcomsoft/forensic-guide-to-imessage-whatsapp-telegram-signal-and-skype-data-acquisition-e7a24e339e50 https://medium.com/

Answering myself; https://medium.com/@elcomsoft/forensic-guide-to-imessage-whatsapp-telegram-signal-and-skype-data-acquisition-e7a24e339e50 https://medium.com/@elcomsoft/forensic-guide-to-imessage-wha... Signal; -Legal requests: Signal does not keep communication histories its servers. Since there is nothing to request, Signal conversations cannot be obtained with legal requests. -Vendor cloud: Signal does not keep conversations on its servers. Cloud acquisition is not possible. -Local backups: Signal does not store conversations in local (iTunes) backups. -iCloud backups: Same as above. Signal does not store conversation histories in iCloud backups. -iCloud Drive: No stand-alone backups in iCloud Drive. -File system: Signal database is encrypted. The encryption key is stored in the keychain with the highest protection class. Extracting and decrypting the keychain (e.g. with Elcomsoft iOS Forensic Toolkit) is required in order to decrypt the Signal database. Telegram; -Legal requests: Telegram keeps a comprehensive history of the user’s regular (non-secret) chats on its servers. Regular and group chats can be obtained with a legal request depending on jurisdiction. Secret chats are never stored and cannot be obtained with a legal request. Telegram is notable for ignoring legal requests in some jurisdictions, which had led the service banned in several countries. -Vendor cloud: As mentioned above, Telegram keeps the history on its own servers. By authenticating as a user, one can retrieve those communications (except secret chats) from Telegram servers. -Local backups: Telegram does not store conversations in local backups. Instead, conversation histories are synchronized using Telegram’s own cloud service. -iCloud backups: Same as above. Telegram does not store conversation histories in iCloud backups. -iCloud Drive: There are no stand-alone backups in iCloud Drive. -File system: Telegram does not feature any additional protection to the working database. Once a file system image is captured from the iPhone, extracting and analyzing Telegram conversations including secret chats and attachments is trivial.