OneDrive Evidence

ONEDRIVEEVIDENCE · AGUIDEFORUKLAWYERS OneDrive Evidence Sync, Versions, Deleted Files and Sharing: the Personal Drive That Is Never Only in One Place COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM EXFILTRATION ANALYSIS CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: one drive, two truths 03 Cloud-side anatomy: versions, recycle stages, sharing states 04 Device-side anatomy: the sync client's confessions 05 Collection: both halves, with the joins planned 06 Deletion, the leaver clock and recovery 07 Exfiltration patterns and how they prove 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : ONEDRIVEISTWOSOURCESWEARINGONENAME , ANDTHECASE USUALLYLIVESINTHEIRDIFFERENCES § 0 2 · FIRSTPRINCIPLES The problem in plain English: one drive, two truths § 0 3 · THECLOUDHALF Cloud-side anatomy: versions, recycle stages, sharing states § 0 4 · THEDEVICEHALF Device-side anatomy: the sync client's confessions § 0 5 · GETTINGBOTH Collection: both halves, with the joins planned § 0 6 · GONE , GOING , KEPT Deletion, the leaver clock and recovery § 0 7 · THEPATTERNS Exfiltration patterns and how they prove § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE STORE + PART Y PERSONAL CLOUD THIRD- SHARED-OUT / LAYERS BACKUP ACCOUNTS SYNCED AUDIT / DELETED / DEVICES SIGN-IN RECOVERABLE § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THEEMPTYDRIVEANDTHEDISCONNECTEDLAPTOP EXAMPLE2 · THEANYONE - LINKWITHATIMESTAMPEDAUDIENCE EXAMPLE3 · THEVERSIONHISTORYTHATACQUITTEDTHEEDITOR § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · ONEDRIVELIMBFORTHECOLLECTIONSPECIFIC AT ION § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The OneDrive checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Files were deleted from OneDrive six months ago, unheld. Gone? Can we tell if someone downloaded the whole drive before resigning? What does a sharing link actually prove? The custodian says the sync client "did things on its own". Plausible? How do OneDrive and SharePoint evidence differ? What single step most often decides OneDrive matters? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY