Digital Forensic Acquisition and Analysis of Discord Applications

Abstract

Digital forensic analyses are being applied to a variety of domains as the scope and potential of digital evidence available is vast. The importance of forensic analyses of web-based devices and tools is increasing, coinciding with the rise in online criminal activity. Discord - an application that allows text, image, video, and audio communication using VoIP - has become increasingly popular and is consequently subject to increased use by cybercriminals. While researching Discord servers and forensic artefacts, it is apparent that there is limited literature and experimentation in this domain. This paper presents our research into digital forensic analyses of Discord client-side artefacts and presents DiscFor, a novel tool designed for the extraction, analysis, and presentation of Discord data in a forensically sound manner. DiscFor creates a safe copy of said data, presenting the current cache state and converting data files into a readable format.