DFIRHub

OneDrive_UserFiles

Microsoft OneDrive Storage Files

  • Apps
  • 1 path
  • Per-user data
  • Version 1
  • Chad Tilbury

Paths on disk

1 path

Paths use Windows environment variable syntax

Notes

This target collects user OneDrive files from the default folders of OneDrive Personal and Business, but folders can be user-defined. Check NTUSER.DAT\Software\Microsoft\OneDrive\Accounts\<Personal|Business> to see if locations have been changed.

References

2 links