// artifact family
desktop chat clients (non-china)
21 browser-only forensics tools in this catalog group — browse by artifact family when you know the kind of evidence you are working with, not the investigation pattern.
tools in this family
ordered as in the forensics catalog. every tool runs locally — no upload, no account.
- signal desktop artifact forensic extractordrop signal desktop %APPDATA%Signal · parse encrypted leveldb config + sql.sqlite (key-derived) · surface conversation + attachment metadata · runs locally
- signal desktop disappearing message residue detectordrop signal desktop leveldb + sql · detect remnants of disappeared-message rows in WAL · runs locally
- telegram desktop tdata artifact forensic extractordrop telegram desktop tdata folder · parse user.id / D877F783D5D3EF8C cache · surface account session + chat history · runs locally
- whatsapp desktop artifact forensic extractordrop whatsapp desktop %APPDATA%WhatsApp · parse IndexedDB + leveldb · surface chat preview + session metadata · runs locally
- whatsapp web indexeddb forensic extractordrop chrome / edge IndexedDB for web.whatsapp.com · parse messages + media keys cache · runs locally
- discord desktop artifact forensic extractordrop discord desktop %APPDATA%discord · parse leveldb + Local Storage · surface guild + DM cache + token traces · runs locally
- discord canary ptb artifact forensic extractordrop discord canary / ptb cache · parse beta channel artifacts · runs locally
- discord voice call artifact forensic analyzerdrop discord cache + sentry crash logs · reconstruct voice channel join/leave events · runs locally
- slack desktop deep artifact forensic extractordrop slack desktop client Cache + IndexedDB · parse workspace, channel cache, file references · runs locally
- teams desktop artifact forensic extractordrop new teams 2.0 client data · parse messaging cache + meeting history · runs locally
- matrix element artifact forensic extractordrop element desktop indexeddb + EventIndex · parse rooms, e2ee key share events · runs locally
- threema android artifact forensic extractordrop threema android dataDir · parse messages.db (encrypted) + contacts · runs locally
- threema desktop artifact forensic extractordrop threema desktop client data dir · runs locally
- wire artifact forensic extractordrop wire desktop client data dir · parse e2ee message metadata + conversation list · runs locally
- session messenger artifact forensic extractordrop session app data (oxen/loki backed) · parse Conversations + Messages tables · runs locally
- simplex chat artifact forensic extractordrop simplex chat profile dir · parse messages, contacts, queue addresses · runs locally
- briar decentralized chat artifact forensic extractordrop briar android dataDir · parse mesh + onion chat history · runs locally
- mattermost desktop artifact forensic extractordrop mattermost desktop client data · parse cached posts + channels · runs locally
- rocketchat desktop artifact forensic extractordrop rocket.chat desktop client data · runs locally
- gajim pidgin xmpp artifact forensic extractordrop gajim/pidgin profile dir · parse xmpp chat logs + contact list · runs locally
- irc client log forensic analyzerdrop hexchat / mirc / weechat log dirs · parse irc session history · surface channels joined + DMs + scrollback · runs locally