Methodology (High Level)

High-level summary of how source material was produced. This page is not a forensic certificate.

Group 1 — Supergroup (ID 3368344320)

Desktop export of chat history (HTML/JSON; media paths on custodian storage only).
Telethon (MTProto) API scripts for membership lists and user lookups.
24 members successfully extracted via GetParticipantsRequest.
Dual-hash manifests (MD5 and SHA-256) generated with PowerShell.

Joined via invite hash (xNC5xlM-hGQ5YWM8) resolved through CheckChatInviteRequest.
Full message history extracted: 85 messages (Nov 2025 — Apr 2026) via messages.GetHistory / iter_messages.
Member and admin lists blocked — channel restricts GetParticipantsRequest to administrators. The full 478 subscriber list is obtainable via lawful data production request to Telegram FZ-LLC.
All 85 messages show sender_id: null because broadcast channels attribute posts to the channel, not individual users. Server-side sender logs are available from Telegram.
Custom script: extract_group_full.py (Telethon 1.36.0, Python 3.14.0).
Output files: *_FULL.json, *_messages.csv, *_report.txt, *_admins.csv, *_members.csv. All hashed per DOJ/NIST standards.

Public profile metadata via documented third-party JSON endpoints (summary only).
Following-list extraction (24 accounts) via X GraphQL API.
Deep OSINT on followed accounts: bio scanning, tweet scanning for Telegram/Linktree/OnlyFans/Discord links.
Media enumeration and metadata extraction with gallery-dl, using session cookies when applicable.
Official X API v2 returned HTTP 402 (Payment Required) on the free tier; noted in the investigation log.

Tool	Version	Purpose
Telegram Desktop	Native	Chat export (HTML + JSON)
Telethon	1.36.0	MTProto API (user lookups, member dumps, message extraction)
Gallery-dl	1.31.10	X/Twitter media archival
httpx (Python)	Latest	Direct X/Twitter GraphQL API queries
PowerShell	7.6.0	File hashing (MD5, SHA-256)
Python	3.14.0	Custom extraction and analysis scripts