KakaoTalk PC
The Windows desktop client of KakaoTalk stores chat history, contacts, and profile metadata in the user's AppData directory, each per account profile.
Where to find it
Default filesystem paths and registry locations. Collect these with your preferred live-response or disk-image tooling.
- $%LOCALAPPDATA%\Kakao\KakaoTalk\users\{account_id}\
- $%LOCALAPPDATA%\Kakao\KakaoTalk\Cache\
Forensic significance
Common scenarios in which this artifact becomes decisive evidence.
- Workplace investigations — PC client chat evidence
- Cases where the mobile device is unavailable
- Multi-device correlation with KakaoTalk mobile
- PC Cache — multimedia previews still present after cloud delete
Tools that parse it
unJaena AI and other DFIR tools commonly used to extract evidence from this artifact.
Related artifacts
KakaoTalk iOS
Korea's dominant messenger. iOS client stores chatrooms, messages, contacts, and attachment metadata in SQLite databases inside the app sandbox.
KakaoTalk Android
Android client of Korea's dominant messenger. Chatroom list, friends, multimedia thumbnails, and message ledgers are stored in SQLite databases under app data.
Telegram Desktop
Telegram Desktop stores cached chat messages, media, and session metadata in tdata/ — multimedia cache often survives server-side deletion.
iOS SMS / iMessage (sms.db)
iOS stores SMS, MMS, and iMessage conversations in a single SQLite database including timestamps, read receipts, attachments, and reply threading.
Stop parsing artifacts by hand
unJaena AI ingests disk images, live-response output, and mobile backups, then automatically correlates every artifact on this page — and 200+ more — into an investigator-ready timeline.
Try unJaena AI →