There is an old principle in counterintelligence that I find equally applicable to digital forensics: to understand how someone covers their tracks, you first need to understand exactly how they think about covering tracks. It is easy to spend years developing extraction techniques, learning artifact locations, and mastering mobile acquisition workflows. It is less common to sit down and read the documentation written for the people you are investigating.

cover

The P.E.T. Guide (Peer-to-peer, Encrypted, Tor) is one of those documents. Published in 2022, it was written with an explicit political orientation and for purposes entirely separate from law enforcement. I have no interest in that context here. What interests me is that it is a technically detailed, surprisingly well-structured manual describing exactly how a subject attempting to minimize their digital footprint would approach communication security. That makes it required reading for anyone doing DFIR work in environments where privacy-aware subjects are the norm rather than the exception.

In brief

  • The P.E.T. Guide covers encrypted messaging, Tor integration, P2P architectures, and metadata minimization — all topics with direct forensic relevance.
  • Different platforms expose very different metadata profiles: Signal centralizes some server-side data, while apps like Briar and Cwtch route everything through Tor with no central point of contact.
  • Understanding which data is concealed and which inevitably leaks is the foundation of any realistic acquisition and attribution strategy.
  • The guide’s analysis of threat models maps almost directly onto what digital forensics investigators need to think about when designing investigative approaches.
  • A 2026 update titled “Signal Problems” (published on AnarchistNews) refreshes the guide’s recommendations, introducing SimpleX Chat and revising assessments of Briar and Cwtch.
  • The combination of original guide and recent update provides an unusually clear picture of the current private communications landscape.

The forensic value of a privacy manual

The guide’s framing is adversarial toward surveillance, which means it approaches the question of metadata with unusual rigor. Rather than reassuring its readers that a given app is “secure,” it asks specifically: what does this service know about you, what does your phone retain, what can an adversary with access to the network observe, and what happens if the platform itself is compromised or compelled to produce records?

These are, almost verbatim, the questions a forensic investigator should ask when evaluating what evidence is recoverable from a given communications platform. The P.E.T. Guide treats metadata as a first-class concern rather than an afterthought. It distinguishes between message content (which end-to-end encryption generally protects well) and communications metadata: who contacted whom, when, how frequently, from which network location, using which device identifiers. This distinction is critical in the field. As I noted in my analysis of Signal notifications and FBI forensic access, encryption protects the channel; it does not necessarily protect the metadata layer or what the operating system does with content once it arrives.

The guide also addresses operational security failures with a candor that vendors rarely match. It explains that using an encrypted messenger from a device tied to your real identity, on a network that logs connection times, largely defeats the purpose of the encryption. This is precisely the kind of behavioral residue that investigators find most useful.

Messaging platforms through a forensic lens

The guide dedicates substantial space to analyzing specific messaging platforms, and this section is where it becomes most directly useful for investigators. It examines Signal, Molly (a hardened Signal fork for Android), Ricochet Refresh, Telegram, Briar, and Cwtch through the lens of centralization, metadata exposure, Tor integration, and threat model fit.

Signal receives a nuanced assessment. The guide acknowledges its strong cryptographic foundation while noting that it requires a phone number for registration (linking identity), that Signal’s servers log contact discovery and account creation timestamps, and that sealed sender only partially addresses metadata leakage. From a forensic perspective, this is significant: Signal leaves a more recoverable artifact trail than its reputation suggests, something I have explored in depth in the context of Telegram forensics and broader messaging analysis. The earlier post on why WhatsApp and Telegram messages are not really private covers some of the same ground and remains relevant.

Telegram receives a more critical treatment. The guide correctly identifies that Telegram’s default mode does not use end-to-end encryption, that Secret Chats (which do) leave no server-side copy but are device-specific, and that Telegram’s cloud-based architecture makes it a rich source for investigators who obtain legal process against the platform. On that front, the forensic picture has shifted considerably as Telegram has become more cooperative with law enforcement requests since 2024.

Briar and Cwtch represent the other end of the spectrum. Both route all traffic through Tor and operate on a pure peer-to-peer model with no central server. Briar can even fall back to Bluetooth and Wi-Fi direct connections, functioning as a mesh network in environments without internet access. From a forensic standpoint, this architecture is genuinely challenging: there is no service provider to compel, no server logs, and contact graph information exists only on devices. Recovery depends entirely on physical or logical access to the endpoint, where the forensic analysis of the device itself becomes the only viable path. The iOS forensics without jailbreak guide and the iOS Lockdown Mode forensics post are relevant here, since subjects using these tools are often also using hardened device configurations.

Tor, P2P architectures, and what they mean for attribution

The guide’s treatment of Tor is technically sound and directly relevant to understanding investigative constraints. It explains the onion routing model accurately: traffic enters the network through a guard node, passes through a middle relay, and exits through an exit node, with each hop knowing only its neighbors in the chain. Content is encrypted in layers. The exit node can see the destination but not the source; the guard node can see the source but not the destination. No single node has the full picture.

For investigators, the practical implication is that traffic analysis attacks against Tor require global network observation capabilities that most actors do not have. What remains exploitable at the endpoint level is considerable, however. Browser fingerprinting, application-layer identifiers, timing correlations, and operational security failures (logging into a real account while using Tor, for example) have been responsible for most documented Tor de-anonymization cases. The guide acknowledges this with reasonable accuracy.

The P2P architectures described for Briar and Cwtch add another layer of complexity. In a centralized service, the forensic investigator has a natural pressure point: the provider. In a fully decentralized system, the contact graph, message history, and cryptographic keys exist only in distributed form across participant devices. The investigative consequence is a shift in strategy: instead of legal process against a provider, the focus moves to device acquisition and endpoint analysis. This connects directly to the challenges of attribution in digital forensics, where building the link between a device artifact and an accountable individual requires a different evidence chain than server log analysis.

What the Signal problems update reveals about the changing landscape

The P.E.T. Guide is now about four years old, which in the encrypted messaging space is a meaningful gap. A 2026 post titled Signal Problems (published on AnarchistNews) functions as an update to the guide, and it is worth reading alongside the original document.

The update revises several assessments. It introduces SimpleX Chat as a notable option that the original guide predates. SimpleX is architecturally distinct from Signal and most other messengers in that it does not assign users any persistent identifier — no phone number, no username, no user ID of any kind. Contact is established through single-use invitation links, and the server only sees encrypted message queues associated with temporary addresses. From a forensic perspective, this creates a different artifact profile than Signal: there is no account identifier to subpoena and no registration metadata, though device-side artifacts still exist and remain recoverable through standard mobile forensic methods.

The update also notes that Briar’s development has continued and its threat model remains sound, while offering updated guidance on operational security practices around device hardening that have shifted as Android and iOS security models evolved. The Android pattern-of-life analysis post is useful context here: even subjects using privacy-maximizing communication tools leave behavioral traces in operating system logs that careful forensic analysis can reconstruct.

One honest assessment the update makes, and that the original guide also implies, is that no single tool provides complete protection across all threat models. A subject using Cwtch on a device with an unencrypted backup, or Briar on a device that has been paired with a cloud account, has built a sophisticated front door and left the back window open. Investigators familiar with iOS forensic acquisition techniques and cloud forensics jurisdictional issues will recognize this pattern immediately.

Practical implications for DFIR investigators

Reading the P.E.T. Guide as an investigator produces a fairly clear checklist of questions to answer before designing an acquisition and analysis strategy for any case involving privacy-aware subjects:

  • Which messaging platforms are present on the device, and what is each platform’s server-side data retention policy?
  • Does the subject use a phone number-linked account (Signal, Telegram) or an identifier-free system (SimpleX, Cwtch)?
  • Is there evidence of Tor Browser or Tor-based app usage (Briar, Onion Browser), and if so, what does the device-side artifact trail look like?
  • Are backups enabled, and if so, where are they stored and what do they contain?
  • What operational security failures, if any, are visible in the artifact record — logins from non-Tor connections, contact discovery events, or metadata that contradicts the claimed usage pattern?

The last point is often the most productive. The gap between a subject’s stated or apparent operational security posture and the actual artifact record is where cases are built. A subject who uses Briar exclusively for sensitive communications but logs into a real email account from the same device and network has effectively undermined the entire architecture.

The P.E.T. Guide and its 2026 update are, inadvertently, a fairly complete map of that gap. The guide tells you what its intended audience believes they are hiding. The forensic challenge is finding what they are not.

FAQ

What is the P.E.T. Guide?

The P.E.T. Guide (Peer-to-peer, Encrypted, Tor) is a document published in 2022 that explains how to use privacy-enhancing technologies to reduce surveillance exposure. It covers encrypted messaging apps, Tor, P2P architectures, and metadata minimization strategies.

Why should digital forensics investigators read the P.E.T. Guide?

Understanding how subjects attempt to minimize their digital footprint is essential for building effective investigative strategies. The guide describes in detail which metadata is produced, which can be concealed, and which inevitably remains — all directly relevant to forensic attribution and evidence acquisition.

What messaging apps does the P.E.T. Guide analyze?

The guide covers Signal, Molly, Ricochet Refresh, Telegram, Briar, and Cwtch, evaluating each for metadata exposure, centralization, Tor integration, and threat model fit. A more recent update also introduces SimpleX Chat as a notable newer option.