Microsoft Teams (classic and new client)

What it is

Microsoft Teams is a web application wrapped in a desktop client. The classic client (1.x) was built on Electron; the new Teams client (2.x, package MSTeams) uses Microsoft Edge WebView2. In both cases the client keeps a local copy of recent conversations, call logs, contacts and meeting data in Chromium storage: IndexedDB and Local Storage, both implemented on top of LevelDB, plus a disk cache and text logs.

Classic Teams has been blocked since 1 July 2025, so current endpoints run the new client, but older images and upgraded profiles still hold classic data. The local cache is only a partial copy: the authoritative record lives in Microsoft 365.

Location

LevelDB folders must be copied whole (*.ldb, *.log, MANIFEST-*, CURRENT): records live partly in the .log write-ahead file.

What it proves

• Communications: message text, sender, conversation and time for one-to-one chats, group chats, channels and meeting chats cached on this device.
• Calls and meetings: call log entries with participants, direction, start and end times (stored as JSON inside conversation records).
• File sharing: links and names of files shared in chats (the files themselves live in OneDrive or SharePoint).
• Account use: which tenant and account signed in on this device, from desktop-config.json/storage.json (classic) and logs.
• It does not hold a complete history: only what the client synchronised and cached. Absence of a message locally proves nothing; use the tenant's records.

Key fields

Timestamps

Retention and clearing

• The client cache holds what was recently loaded; old conversations may never have been cached on a given device.
• LevelDB compaction rewrites files and discards old record versions, but edited or deleted messages can linger in .log and older .ldb files until compaction runs.
• Clearing the Teams cache (Microsoft's documented fix is to delete the MSTeams folder contents) wipes local evidence; recreated folders with recent creation times are a clue.
• On the service side, Microsoft Purview retention policies decide how long chats survive in TeamsMessagesData; a user deleting a message does not remove it from a retained compliance copy.

Collection

• KAPE target: MicrosoftTeams. It collects the classic %APPDATA%\Microsoft\Teams IndexedDB, Local Storage, Cache and desktop-config.json, and a logs path under the MicrosoftTeams_8wekyb3d8bbwe package. It does not cover the new client's MSTeams_8wekyb3d8bbwe folder: add it manually.
• Velociraptor (Windows.Triage.Targets): MicrosoftTeams (same coverage and same gap).
• Built-in: quit Teams first (LevelDB files are locked while it runs), then copy the whole folder.

robocopy "C:\Users\alice\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams" E:\case\teams-new /E /COPY:DAT /R:1 /W:1
robocopy "C:\Users\alice\AppData\Roaming\Microsoft\Teams" E:\case\teams-classic /E /COPY:DAT /R:1 /W:1

• Cloud: request a Purview eDiscovery export of the custodian's Teams content, or use the Microsoft Graph export APIs (/users/{id}/chats/getAllMessages, /teams/{id}/channels/getAllMessages, application permissions required), which return chatMessage JSON.

Parsing tools

• forensicsim (Alexander Bilz, open source): ms_teams_parser.exe turns a Teams IndexedDB folder into JSON (messages, reactions, contacts, calendar entries), with an Autopsy module. Written for classic Teams; a 2026 study found it unreliable on the new WebView2 client.
• dfindexeddb (Google, open source): low-level Chromium IndexedDB/LevelDB parser with JSON output, used to analyse new Teams.
• ccl_chromium_reader (CCL Solutions, open source): Python library that reads Chromium LevelDB, IndexedDB and Local Storage.
• LevelDBDumper (Matt Dawson): dumps raw LevelDB key/value pairs.
• ChromeCacheView (NirSoft): browse the Teams disk cache for images and avatars.

Investigation tips

• Start with the tenant: a Purview or Graph export is complete and attributable, and the local cache then shows what the device actually displayed and when.
• Search LevelDB with a proper parser, not strings: values are compressed (Snappy) and a keyword search on raw files misses messages.
• Use originalArrivalTime for ordering and correlate calls with SRUM network usage by ms-teams.exe during the same hour.
• Shared files point to OneDrive or SharePoint URLs: check the OneDrive client and browser artifacts for access to them.
• Toast pop-ups for incoming messages may survive in the notification database after the chat itself is gone.
• Deleted or edited messages sometimes remain in older LevelDB records; parse every .ldb and .log file, not just the current view.