Windows Forensics Cookbook

OneDrive forensics

OneDrive is Microsoft's cloud service, which allows users to save their data on the cloud and access it from any machine, as long as they are logged in with their Microsoft account. Featuring Word, Excel, PowerPoint, Outlook, a calendar, contacts, and more, this is a straightforward way for users of Microsoft products to ensure that they never lose access to their documents. It is also a great source of information and data in forensic investigations.

One way in which OneDrive is especially useful to forensic investigators is in instances where a particular device cannot be accessed for one reason or another. For example, perhaps a phone has been seized, but it is locked and the passcode cannot be retrieved; or perhaps ...