Claude Desktop State and Storage

Overview

Beyond conversations and agent sessions, Claude Desktop keeps a scatter of small state files and standard Chromium web storage. Individually they are minor. Together they fix account identity, device identity, timing, and user activity that the larger artifacts leave out: who was signed in, which device this was, when the app started, what the user was typing but never sent.

Paths are under ~/Library/Application Support/Claude/ unless noted. Many of these files hold tokens or device keys, so collect them as evidence but redact values in reports.

Application State Files

Small JSON files at the top of the profile. File names were observed on the reference build, and the set changes between versions.

What they are good for:

• Device identity. ant-did and ant-device-registry.json identify the device to the service. They can link a Mac to server-side records and distinguish devices on one account. Treat values as identifiers and possibly secrets.
• Account. config.json holds the last known account UUID, which should match the UUIDs in the session paths and the IndexedDB store.
• Remote use. Bridge and remote-control state show whether the machine was set up to be driven remotely.
• Timing. config.json fields (first launch, running instance with boot epoch, last quit) feed the timeline described in Claude Desktop.

Encrypted values in config.json (for example the OAuth token cache and DXT allowlist cache) are base64 strings starting with v10: Electron safeStorage ciphertext. They are recorded as present or absent and not decrypted.

Sentry

The app includes the Sentry crash reporter, which keeps a local scope and an event queue.

scope_v3.json is a compact record of the host environment at the last app start, and its timezone field is an independent source for interpreting local-time logs (see Logs). Breadcrumbs show the pages and actions the user navigated, in order, up to the point of a crash or flush.

Local Storage and Session Storage

Standard Chromium web storage for the claude.ai origin.

These are the same stores covered for browsers in Chrome Local Storage. Values are key-specific strings, often JSON.

Keys of Interest

Key names depend on the web front end the app loads, which changes without a desktop update. Inventory all keys and their sizes, and read values for the keys that matter. As with IndexedDB, LevelDB history can preserve earlier values of a key, including earlier drafts.

macfor emits a record for every key with its size and value type, and the value itself only for an allowlist (drafts, default model, first-login flag) unless include_storage_values is set.

Cookies

The database uses the standard Chromium cookie schema (see Chrome Cookies). Useful columns are host, name, path, created, expires, last access, and last update times, and the secure, HTTP-only, and same-site flags. Times are Chromium microseconds since 1601-01-01 UTC. Values are encrypted with Electron safeStorage and are not decrypted. The host and name pattern shows the session cookies the app held, and creation and last-access times show when sign-in and use occurred.

Updater State

These give the update history and what the updater fetched. Cache.db URLs and preference values can carry identifiers.

Investigation Notes

• Unsent drafts. Look in Local Storage first for text the user wrote and abandoned.
• Identity. Combine account UUID (config), Sentry user ID, and device ID to tie activity to an account and a machine.
• Timeline. Sentry start and boot times, config.json run times, cookie creation, and updater state corroborate logs.
• Residual keys. Deleting a conversation or logging out may leave storage keys and cookies behind.

What macfor Collects

The ai.claudedesktop plugin emits claude_state (one per file, with a typed kind), claude_sentry_scope, claude_sentry_breadcrumb, claude_web_storage_key, claude_cookie (never the value), claude_update_event, claude_nsurlcache_entry, claude_install, and claude_app_config. Redaction applies by default. State, Sentry, and cookie files that mainly hold secrets are copied only with include_secrets. Options: skip_state, skip_storage, skip_cookies.

{
  "type": "claude_web_storage_key",
  "store": "local",
  "origin": "https://claude.ai",
  "key": "example-draft-key",
  "value_size": 42,
  "value_type": "string",
  "value": "Example unsent draft text"
}

All values above are illustrative.

References

• Claude Desktop
• Chrome Local Storage
• Chrome Cookies
• Sentry — Electron