beercow.bsky.social

OneDrive now records volume id, drive letter, and volume name of removable devices. So much winning.

OneDriveExplorer is getting thumbnails in a future release!

OneDriveExplorer is getting thumbnails in a future release!

OneDriveExplorer is getting thumbnails in a future release!

OneDriveExplorer is getting thumbnails in a future release!

OneDriveExplorer is getting thumbnails in a future release!

Looks like Offline Mode is being added to OneDrive Personal.

Thumbnails started appetin OneDrive Databases.

I needed a way to password protect html reports, so I wrote one myself. github.com/Beercow/HTML...

Combining Fuji Cartridge and WinFE into a single setup that can handle forensic imaging for both macOS and Windows systems. #DFIR malwaremaloney.blogspot.com/2026/04/last...

Coming soon. How to build a combined Fuji recovery and WinFE drive. #DFIR

Coming soon. How to build a combined Fuji recovery and WinFE drive. #DFIR

Made an update to XstReader. It was unusable with larger ost files. It now loads large ost files in seconds making it usable again. Have a pull request in but not counting on it being accepted due to inactivity. Let me know what you think. #DFIR github.com/Beercow/XstR...

When you get a group text and fix the name and picture for them.

A couple OneDrive updates this week. malwaremaloney.blogspot.com/2025/12/oned...

Fixed a bug in DeXRAY for Windows Defender files. 🙂 www.hexacorn.com/blog/2025/12...

Fixed a bug in DeXRAY for Windows Defender files. 🙂 www.hexacorn.com/blog/2025/12...

📢 I partnered with @13cubed.bsky.social for another giveaway! 🎁 🏆 1 winner will receive a 13Cubed Investigator T-Shirt + the XPlat Bundle Complete 👕 5 winners will receive 13Cubed Investigator T-Shirts To Enter: Like, Comment, and Repost #DFIR #DigitalForensics #IncidentResponse

Not that kind of consent. The UAC kind of consent. Take a dive into how UAC works and some of the things it doesn’t tell you. Also a new utility to solve some of these issues. malwaremaloney.blogspot.com/2025/11/lets...

When launching a program as admin, consent.exe runs with a parent process of svchost. If successful, consent.exe exits and the new process is launched with explorer as its parent. If not, we can’t always tell what was trying to be ran. Until now. github.com/Beercow/Cons...

When launching a program as admin, consent.exe runs with a parent process of svchost. If successful, consent.exe exits and the new process is launched with explorer as its parent. If not, we can’t always tell what was trying to be ran. Until now. github.com/Beercow/Cons...

Into the unknown and down rabbit holes we go.

Weekly update. New features in OneDriveExplorer, Onedrive Evolution and schema updates. #DFIR malwaremaloney.blogspot.com/2025/11/oned...

Weekly update. New features in OneDriveExplorer, Onedrive Evolution and schema updates. #DFIR malwaremaloney.blogspot.com/2025/11/oned...

Adding a parser for Microsoft.FilesOnDemand.db to OneDriveExplorer. Yet another source to rebuild the user’s OnDrive. More to come. #DFIR

Did a little digging in Microsoft.FileUsageSync.db. Found some information to piece together OneDrive Quick Access. #DFIR malwaremaloney.blogspot.com/2025/10/oned...

Did a little digging in Microsoft.FileUsageSync.db. Found some information to piece together OneDrive Quick Access. #DFIR malwaremaloney.blogspot.com/2025/10/oned...

In case you missed it. New release of OneDriveExplorer. It has a dedicated parser for MicrosoftListSync.db (offline mode). #DFIR malwaremaloney.blogspot.com/2025/09/oned...

That time of year again when everybody starts abbreviating cybersecurity awareness month as CSAM. 21 pages deep of google searches for that term and not a single mention of cybersecurity awareness month. Go figure.

OneDrive Evolution has been updated to v25.162.0820.0001. That’s 692 versions OneDriveExplorer now handles. SafeDelete.db has been updated to schema v9. Enjoy! malwaremaloney.blogspot.com/p/onedrive-e... malwaremaloney.blogspot.com/p/safedelete...

Appears OneDrive snuck a new sync client in. Works with personal accounts at the moment. It’s WebView2. You can find data in the following locations: AppData\Local\Microsoft\OneDrive\OD4 AppData\Local\Microsoft\OneDrive\Logs\OD4 Where are my browser forensics experts at? #DFIR

Updated OneDrive Evolution. You can now compare two versions of OneDrive and see what has changed. #DFIR malwaremaloney.blogspot.com/p/onedrive-e...

Something you may not know. OneDriveExplorer also works for the OneDrive sync client for macOS. github.com/Beercow/OneD...

Today we learned Fishrocket (the one with the doughnut) has cancer. It’s an aggressive form of mast cell tumors. Treatment usually involves removing them but there are too many. They prescribe prednisone because they itch. Has diabetes so can’t give him prednisone. Poor guy.

1/ I successfully tested a LSASS dumping technique on a Windows 10 lab machine, which we encountered on a recent Incident Response engagement (no EDR, default Defender installed). The "MiniDumpWriteDump" technique, as described here [1], was successful in writing the LSASS process to disk.

Another interesting forensic artifact in OneDrive. UXDatabase.db

Updates on the OneDrive sync client. malwaremaloney.blogspot.com/2025/06/week...

New folder and databases in the OneDrive sync client. Not sure what feature they are tied to yet. More to come. #DFIR

New laptop, new stickes. 😜

Found a few bugs that would cause crashes in OneDriveExplorer around ODL and FileUsageSync. Update available. github.com/Beercow/OneD...

Finally caught up. Updates to OneDrive Evolution and database schemas. malwaremaloney.blogspot.com/2025/05/oned...

Been a little while. Was busy adding support for Microsoft.FileUsageSync.db to OneDriveExplorer. Update brings in data on files shared via email, Teams, SharePoint and more. Thank you Heather Barnhart for the bug report on search function issues. #DFIR malwaremaloney.blogspot.com/2025/05/oned...

Original post: infosec.exchange/@13reak/1143...

Hmmmm. What are we up to here? 🤔

Interesting thing with OneDrive Offline Mode for web. You can get the last two modification times of a file. Could come in handy. #DFIR

I started exploring OneDrive’s FileUsageSync.bd. There is some useful information on files shared via email, Teams, etc… that may not be in the user’s OneDrive. https://malwaremaloney.blogspot.com/2025/02/onedrive-microsoftfileusagesyncdb.html

I am OneDrive.

I just came across email information in one of the OneDrive databases. Sender, recipients, subject, mailbox, attachments, etc… Pretty much everything except the body. More to come. 🤔 #DFIR