Did a little digging in Microsoft.FileUsageSync.db. Found some information to piece together OneDrive Quick Access. #DFIR malwaremaloney.blogspot.com/2025/10/oned...

In case you missed it. New release of OneDriveExplorer. It has a dedicated parser for MicrosoftListSync.db (offline mode). #DFIR malwaremaloney.blogspot.com/2025/09/oned...

That time of year again when everybody starts abbreviating cybersecurity awareness month as CSAM. 21 pages deep of google searches for that term and not a single mention of cybersecurity awareness month. Go figure.

OneDrive Evolution has been updated to v25.162.0820.0001. That’s 692 versions OneDriveExplorer now handles. SafeDelete.db has been updated to schema v9. Enjoy! malwaremaloney.blogspot.com/p/onedrive-e... malwaremaloney.blogspot.com/p/safedelete...

Appears OneDrive snuck a new sync client in. Works with personal accounts at the moment. It’s WebView2. You can find data in the following locations: AppData\Local\Microsoft\OneDrive\OD4 AppData\Local\Microsoft\OneDrive\Logs\OD4 Where are my browser forensics experts at? #DFIR

Updated OneDrive Evolution. You can now compare two versions of OneDrive and see what has changed. #DFIR malwaremaloney.blogspot.com/p/onedrive-e...

Something you may not know. OneDriveExplorer also works for the OneDrive sync client for macOS. github.com/Beercow/OneD...

Today we learned Fishrocket (the one with the doughnut) has cancer. It’s an aggressive form of mast cell tumors. Treatment usually involves removing them but there are too many. They prescribe prednisone because they itch. Has diabetes so can’t give him prednisone. Poor guy.

1/ I successfully tested a LSASS dumping technique on a Windows 10 lab machine, which we encountered on a recent Incident Response engagement (no EDR, default Defender installed). The "MiniDumpWriteDump" technique, as described here [1], was successful in writing the LSASS process to disk.

Another interesting forensic artifact in OneDrive. UXDatabase.db

Updates on the OneDrive sync client. malwaremaloney.blogspot.com/2025/06/week...

New folder and databases in the OneDrive sync client. Not sure what feature they are tied to yet. More to come. #DFIR

New laptop, new stickes. 😜

Found a few bugs that would cause crashes in OneDriveExplorer around ODL and FileUsageSync. Update available. github.com/Beercow/OneD...

Finally caught up. Updates to OneDrive Evolution and database schemas. malwaremaloney.blogspot.com/2025/05/oned...

Been a little while. Was busy adding support for Microsoft.FileUsageSync.db to OneDriveExplorer. Update brings in data on files shared via email, Teams, SharePoint and more. Thank you Heather Barnhart for the bug report on search function issues. #DFIR malwaremaloney.blogspot.com/2025/05/oned...

Original post: infosec.exchange/@13reak/1143...

Hmmmm. What are we up to here? 🤔

Interesting thing with OneDrive Offline Mode for web. You can get the last two modification times of a file. Could come in handy. #DFIR

I started exploring OneDrive’s FileUsageSync.bd. There is some useful information on files shared via email, Teams, etc… that may not be in the user’s OneDrive. https://malwaremaloney.blogspot.com/2025/02/onedrive-microsoftfileusagesyncdb.html

I am OneDrive.

I just came across email information in one of the OneDrive databases. Sender, recipients, subject, mailbox, attachments, etc… Pretty much everything except the body. More to come. 🤔 #DFIR

OneDriveExplorer now supports and parses Offline Mode for web. https://malwaremaloney.blogspot.com/2025/02/onedriveexplorer-offline-mode-edition.html

https://www.msn.com/en-gb/money/technology/microsoft-onedrive-for-business-allegedly-keeps-ocr-ed-data-in-an-unprotected-format/ar-AA1xXUyl?ocid=entnewsntp&pc=LCTS&cvid=bfb3ccf8c62447bb85c4cbf855defaec&ei=35

There seemed to be enough interest so I decided to do a write up on what I have found about OneDrive Offline Mode. Hate to burn a forensic artifact but I’m concerned about what Microsoft feels is secure. #DFIR https://malwaremaloney.blogspot.com/2025/01/onedrive-offline-mode-recallish-vibes.html

Did you know you can run Autopsy Automated Ingest Nodes as a service. This eliminates human interaction and survives reboots. https://malwaremaloney.blogspot.com/2025/01/running-autopsy-auto-ingest-in-headless.html

Added new artifact to All Things OnDrive. <UserCid>_import.dat is created when “Save photos and videos from device” is enabled. It records data on imported photos and videos. https://malwaremaloney.blogspot.com/p/location-localappdatamicrosoftonedrives_16.html

Autopsy Hardening Guide: Part 2. This post covers encrypting passwords and securing the web-console of ActiveMQ. malwaremaloney.blogspot.com/2025/01/auto...

Added new artifact to All Things OnDrive. <UserCid>_screenshot.dat is created when “Save screenshots I capture to OneDrive” is enabled. It records data on the last screenshot saved. https://malwaremaloney.blogspot.com/p/location-localappdatamicrosoftonedrives.html

Part 1 of the Autopsy hardening guid is up. This goes over points to make PostgreSQL and Solr more secure. #DFIR https://malwaremaloney.blogspot.com/2025/01/autopsy-hardening-guide-part-1.html

Did a quick update to DFIR_Toolbar. Executable created. Now to work on the Readme. https://github.com/Beercow/DFIR_Toolbar/releases

Thought I’d do something fun. Presenting the DFIR_Toolbar. Basically a toolbar that can be anything you want it to be. https://malwaremaloney.blogspot.com/2025/01/dfirtoolbar.html

Python tool that converts Microsoft Defender Antivirus Signatures (VDM) into YARA rules. https://github.com/t-tani/defender2yara

Just a heads up. M$ is OCRing all your images in OneDrive for business in an unsecured database on your desktop/laptop. Happy Friday. #DFIR

Out of necessity, today I wrote and compiled my first extension for SQLite. And it worked!

Getting a little concerned now about OneDrive. Looks like the Recall no one’s talking about.

OneDrive offline mode got pushed out to me today. All I have to say about the db is 😮👀. Going to be a game changer. Lots of digging to do. #DFIR

Work on Microsoft Teams Forensics: hexseven.pl/articles/mic... #DFIR #BlueTeam

See you Miami. Back to colder weather we go.

I released Lyman the other day but didn’t explain whatbit was. https://malwaremaloney.blogspot.com/2024/11/what-is-lyman.html

I would like to introduce Lyman. A tool to aid in the creation of “mapping” cstruct files for OneDriveExplorer. https://github.com/Beercow/Lyman

Just released OneDriveExplorer v2024.11.20. Mainly bug fixes. https://github.com/Beercow/OneDriveExplorer/releases/tag/v2024.11.20

ODE update. Centers around the ODL logs. Better parsing of v3 logs. Distinguishes which key was used to decrypt the log entries. This helps to identify the difference between vault and general logs. Last update before #DFIRCON https://github.com/Beercow/OneDriveExplorer/releases/tag/v2024.11.12