← All artifacts

Discord Desktop

Discord desktop artifacts — server and DM cache, authentication tokens, and downloaded media from the Electron client.

Status
available
CLI plugin
app.discord
Categories
communication, user

Overview

Discord Desktop is Electron-based and follows the same on-disk pattern as Slack and Messenger: IndexedDB for app state, Local Storage for tokens, Cookies for session, Cache for media. Forensic value is medium — Discord is more ephemeral than Slack and caches less message history, but server membership and authentication tokens are durable signals.

Analysis Tips

  • Authentication token: Stored in Local Storage under the token key. Sufficient to authenticate against the Discord API as the user
  • Server enumeration: guilds IndexedDB store reveals every server the user is in, including private/invite-only ones
  • DM history: Limited offline cache — most DMs are fetched on-demand from the API, so cached content reflects what the user has recently scrolled
  • Voice channels: Voice activity isn't stored locally; rely on Unified Logs and network artifacts for voice session evidence
  • Webhook URLs: Cached webhook configurations occasionally appear in IndexedDB and represent exfil pipelines for some attacker tooling

Related Artifacts

References

Data sources

IndexedDB/LevelDB (Chromium IndexedDB)

~/Library/Application Support/discord/

Cached messages, server metadata, user lists, channel state

Local Storage/LevelDB

~/Library/Application Support/discord/

Authentication tokens, user ID, session state, voice settings

CookiesSQLite

~/Library/Application Support/discord/

HTTP cookies for discord.com — session tokens

Cache/Chromium disk cache

~/Library/Application Support/discord/

Cached HTTP responses including avatars and media