Fix: Add backward-compatible handling for missing score column in parsecdCache module #1417
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This pull request improves the parsecdCache.py artifact parser by adding backward-compatible handling for older ParseCD Cache databases that do not contain the score column.
The updated logic dynamically inspects table schema via PRAGMA table_info and safely substitutes NULL AS score when the column is absent. This prevents SQLite errors when processing legacy datasets.
Errors Encountered
When running iLEAPP against the 2020 CTF – iOS dataset, the following error occurred:
It originated from the completion_cache_engagement table, which lacks the score field in older iOS datasets.
Dataset to Reproduce
Source: 2020 CTF – iOS forensic dataset (EngagedCompletions/Cache.db)
Relevant table: completion_cache_engagement
Issue: Table schema does not include the score column
Running get_parseCDCache on this dataset reliably reproduces the error.
The Fix
Verification (Before/After)
Before Fix:
iLEAPP aborts artifact processing with sqlite3.OperationalError: no such column: score
No report generated for this artifact.
After Fix:
Artifact runs without errors.
Rows from older ParseCD Cache files are parsed successfully.
The “Score” column is populated with NULL for datasets that lack the field.
Output verified using the 2020 CTF – iOS Cache.db dataset.