Discord Forensics: The Logs Keep Growing

Voice over Internet Protocol (VoIP) applications are some of the most widely used applications for keeping in contact with people. These popular applications, such as WhatsApp, Skype, and Viber, although prevalent on mobile devices, also offer desktop applications. There has been significant Digital Forensics research into those popular applications, both on mobile and desktop devices. However, research has been lacking regarding more recent VoIP applications such as Discord, which is fast becoming one of the most used communication methods, having millions of registered users. A forensic investigation of Discord can contain valuable information on a suspect's mental state, whereabouts, and even direct evidence of criminal activity. This paper investigates the desktop application for Discord on Windows 10 in terms of forensic merit and cybersecurity. Our results show that plaintext copies of typed message drafts can be recovered along with cached pictures that were sent/received. We discuss the security aspects of any information saved locally and provide guidelines for forensic investigators and users concerning their data privacy.