OneDrive Logs

Overview

Evidence: OneDrive Logs Description: Collect OneDrive Logs Category: Applications Platform: windows Short Name: ondrvls Is Parsed: No Sent to Investigation Hub: No Collect File(s): Yes

Background

Microsoft OneDrive maintains comprehensive logs of synchronization activities, errors, and file operations. These logs track uploads, downloads, conflicts, and sync events for OneDrive and OneDrive for Business.

Data Collected

This collector gathers structured data about onedrive logs.

Collection Method

This collector gathers OneDrive log directories from both OneDrive and Windows OneDrive locations in Local AppData.

Forensic Value

OneDrive logs reveal file synchronization activities, uploads to cloud storage, downloads, sharing events, and sync errors. This is essential for investigating data exfiltration to Microsoft cloud storage, identifying synchronized sensitive files, and establishing timelines for cloud storage activities.