Google Chat is formerly Hangouts and is similar in nature to slack. This chat capability can be embedded within the Gmail application or downloaded from the Play Store as a stand-alone application. The location will either be:
/data/com.google.android.apps.dynamite/dynamite.db – stand-alone app version
/data/com.google.android.gm/databases/user_accounts/%USERACCOUNT% /dynamite.db
There are multiple tables of interest.
Message attachments and video chat information (URL) is stored in BLOBs that are protobuf. The queries below will return messages BLOBs where they exist. For file attachments, the protobuf data does provide the file type and original file name of the file that was sent/received. However, there is no pointer for the file on the local device (if the file was received). Attached media files can be found in the ~/cache/image_manager_disk_cache directory path. Files in this directory path have a .0 file extension, but they are image files. The Modified Time can be aligned with the BLOB entries in the database to determine what files were transferred when. There may be a shelf life for these files, but I haven’t been able to identify it.
Query (For Group Chat info):
SELECT
datetime(Groups.create_time/1000000,'unixepoch') AS "Created",
Groups.name AS "Group Name",
users.name AS "Group Creator",
datetime(Groups.last_view_time/1000000,'unixepoch') AS "Last Viewed"
FROM
Groups
JOIN users ON users.user_id=Groups.creator_id
ORDER BY "Created" ASC
Query for either dynamite.db
SELECT
datetime(topic_messages.create_time/1000000,'unixepoch') as "Timestamp",
groups.name as "Group name",
users.name as "Sender",
topic_messages.text_body as "Message",
topic_messages.annotation as "Message attachments"
FROM
topic_messages
left join groups on groups.group_id=topic_messages.group_id
left join users on users.user_id=topic_messages.creator_id
order by "timestamp" ASC