OneDrive Sync Artifacts
Also called OneDrive ODL logs, SyncEngineDatabase, OneDrive forensics, Files On-Demand placeholders.
- PLATFORM
- Windows
- CATEGORY
- Cloud and Sync
- INDEX
- 34 of 36
- PROVES
- 5 findings
- CANNOT PROVE
- 5 limits
- QUESTIONS
- 3 answered
Client-side logs and databases recording which files the OneDrive client synchronised, when, and in which direction — including files that were only ever placeholders locally.
Where it lives
%LocalAppData%\Microsoft\OneDrive\ — client logs in the logs subdirectory and sync databases in the settings subdirectory
Name the location in the preservation request rather than describing the artifact in general terms. A request that asks for the record by its path is one the responding party can act on and one a court can enforce; a request for “all forensic evidence of onedrive sync artifacts” is neither.
What it records
The client writes operational logs in a compressed, obfuscated format recording sync activity, and maintains databases describing the synchronised namespace: file identifiers, names, sizes, and local availability state. Resolving filenames from newer clients' logs requires the client's own string map, which lives alongside them and must be collected with them. The local availability state matters more than anything else in the artifact, because Files On-Demand means a file visible in a folder may never have been downloaded to the machine at all.
What it proves — and what it cannot
These two panels carry equal weight, deliberately. The right-hand column is not a disclaimer: it is the specific, mechanical reason an inference fails, and it is the column opposing counsel will read back to a witness on cross-examination.
What it proves
FINDINGS THIS ARTIFACT WILL SUPPORT ON ITS OWN TERMS.
- Which files were present in the synchronised namespace, with names and sizes, including files no longer there
- Sync events and their timing, giving a client-side record of upload and download activity
- Which account the client was signed in as, and which tenant or personal account was synchronised
- That a personal OneDrive account was configured on a corporate machine, which is frequently the finding that matters
- Whether a given file was actually downloaded to the endpoint or existed only as a placeholder
What it cannot prove
INFERENCES IT WILL NOT CARRY, HOWEVER STRONGLY IT POINTS.
- That a file listed locally was ever on the machine's disk. Files On-Demand keeps placeholders that occupy no content locally, so a directory listing showing a thousand documents may reflect a thousand files that never left the service
- The full picture of tenant-side activity. The client records what the client did; who else accessed the file, from where, is a tenant audit question
- Anything past the log window. Client logs roll quickly, commonly within days, so they capture the recent past and not a departure three months earlier
- That an absent log means no sync. Logs are per-installation, are removed when the client is reset or the account unlinked, and can be deleted outright
- Filenames, without the accompanying string map. Newer client logs are unreadable in isolation, so an incomplete collection produces an unreadable artifact rather than an empty one
How the finding is attacked
An opinion built on this artifact meets these arguments. Each of them is answerable, and each of them is answered before the report is served rather than at a deposition.
- Showing that files counted as copied were placeholders that never had local content
- Establishing that the client logs rolled before the conduct at issue, making the produced set irrelevant
- Pointing out that a collection which omitted the string map cannot support the filenames in the report
- Arguing that sync activity is the client doing its job, and that direction and intent were not established
What survives, and for how long
Client logs roll on a short cycle — days rather than weeks on an active machine — while the sync databases reflect current state and are reset when an account is unlinked. Tenant-side audit records outlive all of it, which is why the endpoint and the tenant should be preserved together.
More matters are decided by what an artifact never kept than by what it says, which makes preservation timing the most consequential decision in the matter — and it is usually made months before anyone examines anything. The evidence preservation deadline calculator works from the date you first anticipated litigation.
Questions counsel ask
Can OneDrive logs show that files were uploaded?
The client logs record sync activity with filenames and timing, which is client-side evidence of upload and download. They roll quickly, commonly within days, so they speak to the recent past rather than to a departure months earlier. The durable record of what was uploaded, downloaded and shared is tenant-side, in the Microsoft 365 audit log, and it should be preserved alongside the endpoint.
Does a file in a OneDrive folder mean it was on the computer?
Not necessarily, and this is the most consequential trap in cloud-sync evidence. With Files On-Demand, a file appears in the folder as a placeholder while its content stays in the service. A directory listing showing thousands of documents can reflect thousands of files that were never downloaded to the machine. The local availability state has to be checked before any file is counted as present.
Why are OneDrive log filenames unreadable?
Because newer clients store log strings in an obfuscated form that has to be resolved against a string map the client keeps alongside the logs. Collect the logs without the map and the artifact is unreadable rather than empty. That makes it a collection-scope question: an ESI protocol or preservation instruction that names only the log files produces material nobody can interpret.
Terms used on this page
Every term below is defined in the forensic glossary — what it is, why a case turns on it, and what happens when it is mishandled.
Related artifacts
No artifact carries a matter on its own. These are the records that corroborate, contradict, or supply the timeline this one cannot.
Microsoft 365 Unified Audit Log
The tenant-wide record of user and administrator activity across Microsoft 365 — file access and download, mailbox operations, sharing changes and administrative actions.
Dropbox and Google Drive Sync Databases
Local databases maintained by consumer sync clients recording the files in a synchronised account, their state, and a bounded history of sync events.
Entra ID Sign-in Logs
Tenant-side records of every authentication to Microsoft 365 and connected applications, with the application, IP address, device state, and conditional-access outcome — retained for days unless exported.
LNK Shortcut Files
Shortcut files Windows creates when a document is opened through the shell, retaining the target's full path, its size and timestamps, and often the volume serial number of the drive it lived on.
Whether the onedrive sync artifactsevidence in your matter supports the opinion built on it is a question with a testable answer. Law & Forensics retains court-tested digital forensic expert witnesses and forensic neutrals.
A conflicts check and scoping call follow, normally within one business day. Please do not send privileged or case-sensitive material until conflicts have cleared.
- Can This Artifact Prove That?
Start from the claim rather than the artifact: which records bear on it, and what no combination of them establishes.
- Cloud forensics
The examination this artifact is collected and analysed in, scoped to a matter and reported so it can be tested.
- The artifact index
All 36 entries, grouped by what they bear on and filterable by platform.
- Daubert and digital evidence
Why an opinion stated one level too strongly is an admissibility problem rather than a point for cross-examination.
Attorney advertising / expert services. This page describes forensic artifacts and the procedural rules that govern expert evidence in general terms. Artifact behaviour varies by operating-system version, build, and configuration, and every observation has to be verified against the system actually in front of you. Nothing here is legal advice, and it is not a substitute for checking the rules, standing orders, and case law of your own forum.