iOS Discord
14/02/2025 Friday
Discord is very popular among gamers for its user-friendly features, high performance, and ease of use. It has generated so much praise that even if you are not a "true gamer," you might be familiar with the platform. Although Discord was initially centered around games and gamers, the platform has also gained popularity among the general public creating interest communities around education, art, business, and many others.
The platform is available on desktop (Windows, macOS, and Linux), mobile (Android and iOS), and web browsers. Discord communities are organized into "servers" by topic or event, with each server containing multiple "channels." Discord offers users the ability to communicate with voice, video, and text chat and share files and media in private or public through its servers.
Digital Forensics Value of iOS Discord
With over 250 million registered users and 100 million monthly active users, Discord retains critical artifacts like usernames, unique user IDs, timestamps, chats, call records (voice/video), server/channel details, shared files, links, and activity logs. These artifacts provide valuable forensic insights, such as user interactions, communication timelines, and access patterns, which are essential for digital investigations.
Location of iOS Discord Artifacts
iOS Discord artifacts are found in the following locations:
/private/var/mobile/Containers/Data/Application/<App-GUID>/Caches/com.hammerandchisel.discord/fsCachedData/****
/private/var/mobile/Containers/Data/Application/<App-GUID>/Documents/mmkv/mmkv.default
Analyzing iOS Discord Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract Discord artifacts from iOS devices and what kind of digital forensics insights we can gain from the artifacts.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select iOS Discord artifacts:
×
Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of iOS Discord artifacts in ArtiFast.
iOS Discord Account
- Email Cache: The user account’s email address.
- User ID Cache: The user ID.
iOS Discord Calls
- Time: The date and time the call was ended.
- Caller ID: The caller user ID.
- Caller Name: The caller's name.
- Call Date/Time: The date and time of the call.
- Mentioned User Names: The user names of the call participants.
- Mentioned User IDs: The user IDs of the call participants.
- Participants Phone Numbers: The call participants’ phone numbers.
- Channel ID: The ID of the user channel.
iOS Discord Messages
- Time: The date and time the message was sent.
- Sender ID: The message sender user ID.
- Attachment Size: The attachment size.
- Attachment Name: The attachment name.
- Attachment Type: The attachment type.
- Attachment URL: The attachment URL.
- Message Body: The content of the message.
- Channel ID: The ID of the user channel.
iOS Discord Users
- Username: The user name.
- User ID: The user ID.
- Email: The user’s email address.
- Global Name: The user’s global name.
- Phone Number: The user’s phone number.
- Personal Connection ID: The user’s personal connection ID.
- Verified: Whether the user is verified or not.
- Bot: Indicates whether the user is a bot or not.
For more information or suggestions please contact: ekrma.elnour@forensafe.com
