OneDrive sync client

What it is

OneDrive is built into Windows 10 and 11 and is the default place where Microsoft 365 users keep documents. The sync client (OneDrive.exe) runs per user and records three kinds of evidence: account configuration in the user's registry, a metadata database describing every file and folder it knows about (including files that exist only in the cloud), and detailed binary logs of its operations.

This makes OneDrive a key source for data-theft cases: it shows which personal or business account was linked, what was synced to the machine, and when files were uploaded, downloaded or deleted.

Location

What it proves

• Account link: which Microsoft account (e-mail, CID) or tenant was connected under this Windows user, and where it synced.
• Cloud inventory: names, sizes, hashes and status of files and folders in the account, even those never downloaded (Files On-Demand placeholders).
• Activity: ODL logs record uploads, downloads, renames, deletions and sync sessions.
• Deletions: SafeDelete.db and the Recycle Bin show files the client deleted locally.
• It does not show activity performed only on the web (OneDrive in a browser) or on another device, except as changes that later synced down. Use Microsoft 365 audit logs for that.

Key fields

Timestamps

Retention and clearing

• The sync database is rewritten continuously; removed items disappear from it, so keep older copies from volume shadow copies.
• ODL logs rotate and are compressed; only a limited history is kept on disk.
• Since around April 2022, sensitive strings in ODL logs are AES-encrypted with the key in general.keystore (older versions used an ObfuscationStringMap.txt dictionary). Collect the keystore with the logs.
• Unlinking the account or uninstalling OneDrive removes much of settings\; registry keys and logs often survive. Signing out does not delete synced files.
• Files On-Demand (Windows 10 1709+) means a file visible in the folder may never have been on the disk; check fileStatus or hydration data before claiming the user had a local copy.

Collection

• KAPE target: OneDrive_Metadata (the whole %LOCALAPPDATA%\Microsoft\OneDrive folder); CloudStorage_OneDriveExplorer adds RegistryHivesUser and RecycleBin for OneDriveExplorer. OneDrive_UserFiles collects the synced files themselves.
• Velociraptor (Windows.Triage.Targets): OneDrive_Metadata, CloudStorage_OneDriveExplorer.
• Built-in: stop OneDrive or copy from a shadow copy (the databases are open while it runs).

robocopy C:\Users\alice\AppData\Local\Microsoft\OneDrive E:\case\OneDrive /E /COPY:DAT
reg query "HKU\<SID>\Software\Microsoft\OneDrive\Accounts" /s

Parsing tools

• OneDriveExplorer (Brian Maloney, open source): rebuilds the OneDrive folder tree from <CID>.dat or SyncEngineDatabase.db, adds registry, Recycle Bin and ODL log data, and exports CSV, JSON or HTML.
• odl.py (Yogesh Khatri, open source): parses .odl, .odlgz, .odlsent and .aodl logs and decrypts strings with general.keystore or deobfuscates them with the older string map.
• Registry Explorer / RECmd (Eric Zimmerman): review the OneDrive\Accounts keys in NTUSER.DAT.
• DB Browser for SQLite: query SyncEngineDatabase.db and SafeDelete.db directly.

Investigation tips

• A personal account (Accounts\Personal) on a corporate laptop is a classic exfiltration channel: list its files and search the ODL logs for uploads in the relevant window.
• Correlate uploads with SRUM bytes sent by OneDrive.exe and with the USN journal entries for files copied into the sync folder.
• Online-only files carry cloud metadata; use od_HydrationData to show when one was first opened on this device.
• Mass deletions in SafeDelete.db and the Recycle Bin can point to anti-forensics or ransomware activity.
• Check the web side too: browser artifacts show OneDrive or SharePoint access in a browser, and Microsoft 365 audit logs cover activity from other devices.