CloudStorage_OneDriveExplorer

OneDrive and other files used with OneDriveExplorer

Compound
15 paths from 4 artifacts
Per-user data
Version 1
Brian Maloney

Paths on disk

15 paths from 4 targets

Paths use Windows environment variable syntax

Includes 3 targets

Each one is collected with this target

OneDrive_Metadata1 path
RegistryHivesUser9 paths
RecycleBin

Collect it

KAPE command line for CloudStorage_OneDriveExplorer

Source

Destination

--vss--vhdx

kape.exe --tsource C: --tdest D:\Evidence --target CloudStorage_OneDriveExplorer

Note: This is a compound target that references 3 other targets. The KAPE command resolves them natively; the PowerShell/Batch/WSL scripts flatten every referenced path into explicit copy commands.

Run with administrator privileges. KAPE Documentation

Decode with CyberChef

1 recipe for this artifact

Registry BinaryDecode binary registry values(opens in new tab)