Analisis Pemanfaatan Tools Forensik dalam Investigasi Credential Phishing pada Discord Web Menggunakan Metode OSCAR

Abstract

Credential phishing on Discord Web can generate digital traces across browser storage and network traffic, requiring appropriate forensic tools according to the characteristics of each evidence source. This study analyzes the utilization of forensic tools in investigating credential phishing on Discord Web using the OSCAR method, consisting of Obtain, Strategize, Collect, Analyze, and Report. A controlled experimental scenario was conducted using a phishing domain represented in browser and network artifacts as xn--dscord-waa.online. FTK Imager was used to acquire the browser profile, while DB Browser for SQLite, Autopsy, and Wireshark were used for artifact examination. The results show that DB Browser for SQLite identified the phishing URL in browser History, Discord-related cookies, email, and username, while no phishing-domain cookie or saved login data was found. Autopsy identified the phishing domain, login.html, email, and username in browser storage artifacts. Wireshark identified DNS resolution, the phishing server IP address, and TLS SNI associated with the phishing domain and official Discord services. The findings demonstrate that each tool contributes different evidence according to the source and characteristics of the artifacts. The OSCAR method provides a structured workflow for positioning and utilizing forensic tools throughout the investigation.