Discord Forensics: The Logs Keep Growing
Discord Forensics: The Logs Keep Growing
复制标题
Discord 取证：日志不断增长
DOI：
10.1109/ccwc51732.2021.9376133
复制
发表时间：
2021
期刊：
影响因子：
--
通讯作者：
Yung Han Yoon
中科院分区：
文献类型：
--
作者：
Kyle Moffitt;Umit Karabiyik;Shinelle Hutchinson;Yung Han Yoon
互联网协议语音（VoIP）应用程序是用于与人们保持联系的最广泛使用的应用程序之一。这些流行的应用程序，如WhatsApp、Skype和Viber，虽然在移动的设备上很流行，但也提供桌面应用程序。在移动的和桌面设备上，对这些流行的应用程序进行了大量的数字取证研究。然而，对最近的VoIP应用程序（如Discord）缺乏研究，Discord正在迅速成为最常用的通信方法之一，拥有数百万注册用户。对Discord的法医调查可以包含有关嫌疑人精神状态，下落甚至犯罪活动直接证据的宝贵信息。本文调查了Windows 10上Discord的桌面应用程序的取证价值和网络安全性。我们的研究结果表明，键入的邮件草稿的明文副本可以恢复沿着与缓存的图片发送/接收。我们讨论本地保存的任何信息的安全方面，并为法医调查人员和用户提供有关其数据隐私的指导方针。
Voice over Internet Protocol (VoIP) applications are some of the most widely used applications for keeping in contact with people. These popular applications, such as WhatsApp, Skype, and Viber, although prevalent on mobile devices, also offer desktop applications. There has been significant Digital Forensics research into those popular applications, both on mobile and desktop devices. However, research has been lacking regarding more recent VoIP applications such as Discord, which is fast becoming one of the most used communication methods, having millions of registered users. A forensic investigation of Discord can contain valuable information on a suspect's mental state, whereabouts, and even direct evidence of criminal activity. This paper investigates the desktop application for Discord on Windows 10 in terms of forensic merit and cybersecurity. Our results show that plaintext copies of typed message drafts can be recovered along with cached pictures that were sent/received. We discuss the security aspects of any information saved locally and provide guidelines for forensic investigators and users concerning their data privacy.