dfirhub

CloudStorage_OneDriveExplorer

CompoundCompoundv1

Author: Brian Maloney

description

OneDrive and other files used with OneDriveExplorer

includes (4)

paths

15 pathsfrom 4 targets
› paths use Windows environment syntax

collection commands 

# PowerShell Collection Script
# Target: CloudStorage_OneDriveExplorer (Compound Target)
# Use KAPE for compound target collection:
# kape.exe --tsource C: --tdest D:\Evidence --target CloudStorage_OneDriveExplorer

Write-Host "For compound targets, use KAPE directly for best results." -ForegroundColor Yellow

› Save as .ps1 and run as Administrator. Use: powershell -ExecutionPolicy Bypass -File script.ps1

Note: This is a compound target that references 3 other targets. KAPE will automatically collect all referenced artifacts.
› cyberchef recipes

Open in CyberChef to decode values extracted from this artifact.