Discord chats not parsing/displaying

[pkpsmall]

I have an android device (moto g play 2024 running Android 14 security patch 2025-09-01). Cellebrite and Axiom both have data on call logs and messages in Discord. aLEAPP has a category in the index for for Discord Chats but it is blank. Tried with the previous version (3.5) and this version (3.6) with the same results.

[stark4n6]

@pkpsmall any errors in the ALEAPP report? Were there any pattern matches for files found?

[pkpsmall]

After reviewing the log I found this:

discordChats [discordChats] artifact started
Reading discordChats artifact had errors!
Error was 'attachments'
Exception Traceback: Traceback (most recent call last): File "aleapp.py", line 383, in crunch_artifacts File "C:\Users\000358312\AppData\Local\Temp_MEI250202\scripts\artifacts\discordChats.py", line 59, in get_discordChats attachments = (data['message']['attachments']) ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^ KeyError: 'attachments'

For expected byte pattern not found, I only found this in com.android.chrome\cache\Cache\Cache_Data[...] nothing for Discord.

[stark4n6]

@pkpsmall that parser looks to be a bit outdated, and probably needs updated (and fixed for some error checks).

Are you saying that this parser hit on something in Chrome?

[pkpsmall]

I ran the full-meal-deal aLEAPP on the acquisition. When I searched the log for "pattern" I only located something for pattern related to Chrome cache, nothing related to Discord.

[stark4n6]

@stark4n6 I'm not saying looking for the literal term "pattern", I'm saying looking for regex paths related to the Discord Chats parser. If there were no hits then I'm not sure why the parser itself would even run. Can you possibly provide the html report?

Regardless I'm sure Discord has updated things to where this parser is not functional on most newer extractions.

[pkpsmall]

I would not be able to provide the report but I believe I may need to create some test data. If that is the case, I can provide the test data report. It seems that Discord has moved from storing data in SQLite to JSON files (not sure how long ago the change was made).