Messaging Apps Forensics Cheat Sheet

What it is

Most desktop messengers are web technology in a wrapper: Slack, Discord and older WhatsApp Desktop are Electron apps that store data in Chromium IndexedDB, Local Storage (LevelDB) and a disk cache. Signal Desktop keeps an encrypted SQLite database. Telegram Desktop uses its own encrypted tdata store, and the current Microsoft Store WhatsApp app keeps encrypted SQLite databases in its package folder.

Two consequences shape every case: local data is a cache of a cloud service, so it is incomplete, and several apps encrypt it with keys tied to the Windows user (DPAPI), so collection often has to happen on a live, logged-on system.

Location

App	Windows path	Main content
Slack	`%APPDATA%\Slack\` → `IndexedDB\`, `Local Storage\leveldb\`, `Cache\`, `logs\`, `storage\`	Cached messages and workspace state (LevelDB), logs, downloads state
Signal Desktop	`%APPDATA%\Signal\sql\db.sqlite`	SQLCipher database: conversations, messages, attachment metadata
Signal Desktop	`%APPDATA%\Signal\config.json`, `%APPDATA%\Signal\Local State`	Database key (`key` in older versions, `encryptedKey` now) and the DPAPI-protected wrapping key
Signal Desktop	`%APPDATA%\Signal\attachments.noindex\`, `logs\`	Attachments and avatars, application logs
WhatsApp (Microsoft Store app)	`%LOCALAPPDATA%\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\`	Encrypted SQLite databases (with WAL files), `shared\transfers\` media, `profilePictures\`
WhatsApp (legacy Electron app)	`%APPDATA%\WhatsApp\` → `Cache\`, `Local Storage\leveldb\`	Cache and local storage of the WhatsApp Web client
Telegram Desktop	`%APPDATA%\Telegram Desktop\tdata\`	Encrypted settings, session keys and media cache
Telegram Desktop	`%USERPROFILE%\Downloads\Telegram Desktop\`	Files the user saved from chats
Discord	`%APPDATA%\discord\` → `Cache\Cache_Data\`, `Local Storage\leveldb\`	HTTP cache holding message JSON and attachments, account data

What it proves

Account and use: the app was installed and signed in under this Windows profile, with account identifiers (user IDs, phone numbers, workspace names).
Communications: cached message content, contacts and channel names, where not encrypted or once decrypted.
File transfer: received or sent attachments in caches and download folders.
Activity window: log files and cache timestamps show when the client was active.
It does not give a complete history. Clients cache what the user scrolled through; Telegram keeps chat history server-side; disappearing-message settings and remote deletions remove local copies.

Key fields

App / source	Useful data
Slack IndexedDB / LevelDB	Message objects with `ts`, `user`, `channel`, `text`; workspace and user lists
Signal `messages` table	`conversationId`, `body`, `type` (incoming/outgoing), `sent_at`, `received_at`, attachment JSON
Signal `conversations` table	Contact or group name, e164 phone number, profile name
WhatsApp Store app databases	Chats, messages and contacts once decrypted
Telegram `tdata`	Encrypted maps of settings, sessions, cached media and drafts
Discord cache entries	API responses (`/messages`) with message `id`, `author`, `content`, `attachments`, `timestamp`

Timestamps

Timestamp	Set when	Format	Pitfalls
Slack `ts`	Message posted	Unix epoch seconds with a microsecond fraction (string), UTC	Also serves as the message ID
Signal `sent_at`, `received_at`	Sent by the sender / received on this device	Unix epoch milliseconds, UTC	`sent_at` comes from the sender's clock
Discord message ID (snowflake)	Message created	Upper bits = milliseconds since the Discord epoch (2015-01-01 UTC)	Decode the ID even if the JSON `timestamp` is missing
Discord JSON `timestamp`	Message created	ISO 8601, UTC	Cache only holds what the client fetched
Cache / LevelDB file times	File written	NTFS, UTC	Reflect caching, not message time

Retention and clearing

Caches are overwritten as new content arrives; old conversations may be gone locally while still on the server.
LevelDB and SQLite keep deleted data until compaction or vacuum: parse .log/.ldb files and the SQLite WAL (SQLite WAL) for remnants.
Signal and WhatsApp disappearing messages and "delete for everyone" remove rows; Signal keeps no cloud copy.
Uninstalling the Store app removes its package folder; Electron apps often leave %APPDATA% data behind after uninstall.
Since mid-2024 Signal Desktop no longer stores the database key in clear in config.json; it is wrapped with Electron safeStorage, which uses DPAPI on Windows. Offline decryption then needs the user's DPAPI master key (user password or a live extraction).

Collection

KAPE targets: Slack, Signal, WhatsApp, WhatsApp_Media, Telegram, Discord
Velociraptor (Windows.Triage.Targets): the same names.
Gaps: the Signal target collects config.json and db.sqlite but not Local State, db.sqlite-wal or the DPAPI Protect folder; the WhatsApp targets collect cache, Local Storage and media but not the encrypted databases in LocalState. Add them manually.
Built-in: quit the apps first (databases are locked), and when encryption is involved prefer a live collection while the user is logged on.

robocopy C:\Users\alice\AppData\Roaming\Signal E:\case\signal /E /COPY:DAT
robocopy C:\Users\alice\AppData\Roaming\Microsoft\Protect E:\case\Protect /E /COPY:DAT
robocopy C:\Users\alice\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState E:\case\whatsapp /E /COPY:DAT
robocopy "C:\Users\alice\AppData\Roaming\Telegram Desktop" E:\case\telegram /E /COPY:DAT

Platform exports are often the best source: Slack workspace exports (admin), Discord's "Request all of my data" package, Telegram Desktop's "Export Telegram data" (JSON/HTML) and the WhatsApp phone app's chat export.

Parsing tools

ccl_chromium_reader (CCL Solutions, open source): reads LevelDB, IndexedDB and Local Storage for Slack, Discord and legacy WhatsApp.
sigtop (open source): exports Signal Desktop messages and attachments; supports the DPAPI-protected key on Windows when run as the user.
DB Browser for SQLCipher: opens db.sqlite with the raw key (0x + hex key, SQLCipher 4 defaults).
ChromeCacheView (NirSoft): browse Slack, Discord and WhatsApp Chromium caches and extract message JSON and images.
tg-desktop-investigation and TelegramStorageParser (open source): decrypt and parse Telegram tdata when no passcode is set or the passcode is known.
ZAPiXDESK (open source): live-system decryption of WhatsApp Store app databases.

Investigation tips

Prove installation and use first: Prefetch, SRUM network bytes per app, and the per-user folders' creation times.
Ask for a platform export or a legal request to the provider early; the endpoint copy is partial and may be encrypted.
When the machine is live and the user is logged on, collect keys and databases immediately (order of volatility): after shutdown, DPAPI decryption needs the user's password.
Decode Discord snowflakes and Slack ts values to UTC and align them with browser history, since the same services are often used in a browser too.
Message previews shown as Windows toasts can survive in the notification database even when the app's own data is encrypted or wiped.
Check Downloads\Telegram Desktop, Signal attachments and WhatsApp transfers for exfiltrated or received files and hash them.

Desktop messaging apps (Slack, Signal, WhatsApp…)

Tools