Claude Desktop

Overview

Claude Desktop is an Electron application, so most of what it knows about a user lives in ordinary files under ~/Library/Application Support/Claude/. The ai.claudedesktop plugin collects that footprint: conversations the app cached locally, Cowork agent sessions with their audit logs, the MCP servers and extensions the user connected, logs, and application state.

Two things set this collector apart from a file copy. Conversations are recovered from three local sources: the IndexedDB store, the Chromium HTTP cache, and the transcripts embedded in Cowork sessions. And Cowork's agent audit log is checked for tampering by recomputing its HMAC chain.

What Each Source Yields

• Conversations (IndexedDB and HTTP cache) - Messages decoded from V8-serialized IndexedDB records and Simple Cache entries: sender, timestamps, text, thinking blocks, tool calls with inputs, tool results, attachment metadata and branch information. Records seen in both sources are cross-referenced. Deleted conversations may leave tombstones.
• Cowork sessions - Session records with the prompt, model, working folder, user-granted folders, allowed egress domains, enabled MCP tools and timestamps, plus the agent transcripts and the files in each session's outputs/ and uploads/.
• Audit log (audit.jsonl) - One timestamped event per line, each carrying an HMAC that chains it to the line before. The collector recomputes the chain and reports the first broken line, which makes edits, deletions and truncation detectable.
• MCP servers and extensions - Command, arguments, environment variable names, transport, and the resolved path and SHA-256 of local executables. A configured MCP server is a program that runs on the user's behalf, so treat it as a persistence and execution lead.
• Logs and state - Application, MCP and update logs, remote-control state, device registry, Local and Session Storage keys, and cookie metadata.

What the Collector Does Not Guarantee

Conversations are recovered from local caches, not from Anthropic's servers. The result depends on what the app cached and what has not yet been evicted or overwritten, so a recovered set is not a guarantee of complete conversation history. Absence from the collection is not evidence that a conversation did not happen.

Audit verification needs a key. Each session's audit key is stored encrypted by Electron safeStorage, and the collector never reads the Keychain. To verify a chain, supply the key with the audit_key option: either the examiner's "Claude Safe Storage" Keychain password or an already-decrypted key. Without it, chains are reported as unverifiable (key_encrypted) rather than as valid. The key is never logged or written to the evidence container.

Privacy Defaults

• Secrets are redacted in parsed records. Values matching token, secret, key, password, auth and cookie patterns are replaced with a short hash placeholder, so equal secrets still correlate without being disclosed.
• Raw evidence is copied byte-for-byte. Logs, LevelDB stores, transcripts and Cowork outputs are preserved as found and hashed with SHA-256.
• Secret-bearing files are not copied (MCP and app config, cookies, device registry, bridge state, extension settings) unless include_secrets is set.
• Encrypted values are never decrypted. safeStorage values are recorded as present only.
• skip_content collects metadata only: message and tool text is dropped while structure, counts and tool names remain.

Analysis Tips

• Reconstruct agent activity: Use the Cowork audit log to see prompts, tool calls, permission decisions and results in order, then compare against the files in outputs/.
• Check chain status first: A broken line means the log was altered after it was written. Note the line number and treat later events with caution.
• Review MCP servers for persistence: Look for local executables outside standard locations, unexpected arguments, and servers that expose file or shell access.
• Compare sources: A conversation present in the HTTP cache but missing from IndexedDB, or the reverse, indicates partial eviction rather than absence.
• Correlate with the system timeline: Align message and audit timestamps with FSEvents, Unified Logs and Quarantine records to place AI-assisted activity in context.

Related Artifacts

• ChatGPT - Another AI assistant with cached conversations, MCP servers and agent activity
• Slack - Another Electron application with locally cached messages
• Persistence - Cross-check MCP server executables against launch items
• FSEvents - Match files an agent wrote to filesystem activity
• Unified Logs - Correlate agent activity with process launches

References

• Claude Desktop
• Electron safeStorage