DFIRHub

Windows registry artifactOneDrive

Displays folders present within a user's OneDrive

  • Cloud Storage
  • 10 keys
  • NTUSERSOFTWARE

Registry keys

10 keys that RECmd reads for this artifact

  • NTUSER
    Software\Microsoft\Office\*\Common\Internet\Server*\http*\*

    Displays folders present within a user's OneDrive

  • NTUSEROneDriveConsumer
    Environment

    Displays the user's (check HivePath) specified storage location for OneDrive

  • SOFTWARErecursive
    Microsoft\Windows\CurrentVersion\Explorer\SyncRootManager\OneDrive*\UserSyncRoots

    Displays the user's specified storage location for OneDrive

  • NTUSERLastModifiedTimerecursive
    Software\SyncEngines\Providers\OneDrive\*\

    Displays the Last Modified time for the OneDrive Registry key

  • NTUSERMountPointrecursive
    Software\SyncEngines\Providers\OneDrive\*\

    Displays where the OneDrive folder is mounted

  • NTUSERUrlNamespacerecursive
    Software\SyncEngines\Providers\OneDrive\*\

    Displays the URL Namespace for OneDrive

  • NTUSERIsOfficeSyncIntegrationEnabledrecursive
    Software\SyncEngines\Providers\OneDrive\*\

    Office Sync Integration, 0 = Disabled, 1 = Enabled

  • NTUSERLibraryTyperecursive
    Software\SyncEngines\Providers\OneDrive\*\
  • NTUSERInstallPathrecursive
    Software\Microsoft\OneDrive\*\

    Displays the installation path from the user's AppData folder for OneDrive

  • NTUSERLastUpdaterecursive
    Software\Microsoft\OneDrive\Accounts

    Displays the last update time of the Accounts OneDrive Registry key

References

2 links

Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)