Blog >> Google Drive

Investigating Google Drive

06/08/2021 Friday

Google Drive is a service developed by Google for file storage and synchronization. Launched in April 2012, Google Drive helps users to store files, synchronize files between computers, and exchange files on their servers. Moreover, Google Drive offers offline capabilities a part of the Google Docs Editors office suite that permits collaborative editing of documents, spreadsheets, presentations, drawings, forms, and more. For instance, Google Docs, Google Sheets, and Google Slides. Google Drive is available for Microsoft Windows, Apple macOS, and mobile apps for iOS, and Android smartphones and tablets.

Digital Forensics Value of Google Drive Artifacts

Google Drive file contains information about files that users uploaded and synced to Google Drive, cloud data, and configuration. This information is critical during the forensic analysis process as it helps us understand the types of artifacts that are likely to remain for digital forensics investigators.

Location of Google Drive Artifacts

In Windows 10 systems the artifacts are located at: C:\Users\username\AppData\Local\Google\Drive

Structure of Google Drive Artifacts

Google Drive contains information about files that users uploaded and synced to Google Drive. It contains several sub artifacts such as: actions, cached items, files, folders, starred cached items, previewed items, gallery items, and recent actions.

Analyzing Google Drive Artifacts with ArtiFast Windows

This section will discuss how to use ArtiFast Windows to analyze Google Drive artifacts from Windows machines and what kind of digital forensics insights we can gain from the artifacts.

After you have created your case and added evidence for investigation, at the Artifacts Parser Selection Phase, you can select Google Drive Artifact:

Once Artifast parser plugins complete processing artifacts for analysis, it can be reviewed via "Artifact View" or "Timeline View," with indexing, filtering, and searching capabilities. Below is a detailed description of Google Drive artifact in Artifast software.

Google Drive Preferences Artifact

Google Drive Items Artifact

Google Drive Device Artifact

Google Drive Pending Files Artifact

Google Drive Last Execution Date Artifact

Google Drive Sync Artifact

Google Drive Cloud Items Artifact