This skill enables professional-grade digital forensic acquisitions from cloud storage services including Google Drive, OneDrive, Dropbox, and Box. It bridges the gap between remote API-based data collection and local endpoint artifact analysis, allowing investigators to capture metadata, file histories, trashed items, and synchronized local databases. By combining remote API calls with deep analysis of local sync client artifacts, it provides a comprehensive view of a user's cloud activity, ensuring no evidence is missed due to cloud-only or cached file states.
主要功能
01API-based remote acquisition for Google Drive and OneDrive/Microsoft 365
02Generation of forensic acquisition logs for chain of custody documentation
034,121 GitHub stars
04Automated extraction of file metadata from SQLite synchronization databases
05Recovery of deleted/trashed items and historical file revisions
06Local sync client artifact collection for Windows endpoint devices
