One way to determine what a truly unidentified TGID may be is to keep track of the RID's displayed on the scanner or logged using software.
This opens your world to a whole new Database to reference, In other words.. When you start observing RIDS & TGID'S together and build upon what is known, You can see a much broader use of a system. For instance a RID known to be an LE unit on a known TGID that also appears on an unidentified TGID will be a clue as to who is using that TGID.. even if it's encrypted.
Chester Co RIDS are well documented already for example..
wiki.radioreference.com
Another way is to look at the TGID's on a system in logical order (Not by Departments as the RRDB is layed out by default) Most are designed in a logical order and similar TGID's are grouped together in a series, So a TGID that falls into the range of other known TGID's in the same range are usually related..
Chester County Emergency Services Trunking System Profile
www.radioreference.com
The Chester County P25 is once again a good example..
TGID's that are in the..
1xxx series are Law Enforcement
2xxx series are Fire/EMS
3xxx series are EMA
4xxx series are Mutual Aid & Local Government PS
5xxx series are Countywide Agencies & DES
6xxx series are Public Works
You can get them displayed in this way by clicking/changing the sort order..
This is a fairly good method on most well planned and thought out Public Safety Systems.
Business/Private LMR systems may use a similar configuration, but some are just a mess...
aside from the obvious.. Listening to recordings when available in the clear..
Lots of Fun..