Pro plugin

Discord

Collects tokens, messages, cache, server metadata, webhook indicators, and activity artifacts from Discord Desktop

app.discordPromacOS 10.13+v1.0.0communicationusersecurity

Run this plugin

Trigger collection for Discord on its own with the --plugin flag, or include it in a wider sweep by category.

# Just this plugin
macfor-pro collect --plugin app.discord --output ./evidence.zip

# Dry run — list what would be collected
macfor-pro collect --plugin app.discord --dry-run

Compatibility

macOS 10.13+

Licensing: ships in the macfor-pro binary. See Community vs Pro.

Artifacts (7 collected)

Each row corresponds to an entry in the plugin's artifacts.yaml manifest. Optionalartifacts are often absent, and their absence isn't recorded as an error. Plannedartifacts are documented locations the plugin doesn't collect yet. Where a path shows a version range, macfor only tries it when the source's macOS or application version is in that range.

credentials

Artifact	Format	Path	Notes
Discord Tokens discord_tokensSensitivehigh value	leveldb	`~/Library/Application Support/discord/Local Storage/leveldb/`	Authentication tokens extracted from Local Storage LevelDB.

messaging

Artifact	Format	Path	Notes
Discord Messages discord_messagesSensitivehigh value	leveldb	`~/Library/Application Support/discord/IndexedDB/`	Cached messages extracted from IndexedDB LevelDB stores.

media

Artifact	Format	Path	Notes
Discord Cache discord_cachemedium value	binary	`~/Library/Application Support/discord/Cache/Cache_Data/`	Chromium disk cache containing images, media, and API response data.

metadata

Artifact	Format	Path	Notes
Discord Servers discord_servershigh value	leveldb	`~/Library/Application Support/discord/Local Storage/leveldb/` +1 more `~/Library/Application Support/discord/IndexedDB/`	Server (guild) and channel metadata from cached application data.
Discord Security Indicators discord_indicatorsSensitivehigh value	binary	`~/Library/Application Support/discord/Cache/Cache_Data/` +1 more `~/Library/Application Support/discord/Local Storage/leveldb/`	Webhook URLs, bot tokens, and potential C2 indicators across cache and storage.
Discord Raw Files discord_rawOptionalOpt-in	directory	`~/Library/Application Support/discord/`	Raw application data directory for offline analysis.

session

Artifact	Format	Path	Notes
Discord Activity discord_activitySensitivemedium value	sqlite	`~/Library/Application Support/discord/Cookies` +1 more `~/Library/Application Support/discord/blob_storage/`	User activity patterns from cookies, blob storage, and session data.