// artifact family
cloud storage providers
23 browser-only forensics tools in this catalog group — browse by artifact family when you know the kind of evidence you are working with, not the investigation pattern.
tools in this family
ordered as in the forensics catalog. every tool runs locally — no upload, no account.
- azure blob storage audit log forensic analyzerdrop azure storage diagnostic log · parse blob ops
- backblaze personal backup log forensic analyzerdrop backblaze backup client log · parse backup set + file lists
- box desktop artifact forensic extractordrop box drive cache + config · parse sync state + recent files
- box enterprise audit log forensic analyzerdrop box admin audit log · parse user + content + sharing events
- carbonite backup log forensic analyzerdrop carbonite backup log · parse backup history · timeline + findings · runs locally
- dropbox business audit log forensic analyzerdrop dropbox business team_log export · parse member + content events
- dropbox desktop artifact forensic extractordrop dropbox %APPDATA%\Dropbox + cache · parse host.db + sync history + filecache
- google cloud storage audit log forensic analyzerdrop gcs data-access audit log · parse object reads + writes
- icedrive artifact forensic extractordrop icedrive desktop client cache · parse sync state
- idrive backup log forensic analyzerdrop idrive backup log · parse backup + restore events · timeline + findings · runs locally
- mega nz desktop artifact forensic extractordrop mega desktop client data dir · parse sync log + transfers
- nextcloud audit log forensic analyzerdrop nextcloud audit log · parse file + share + login events
- onedrive business audit forensic analyzerdrop microsoft purview onedrive audit export · parse access + share events
- onedrive personal artifact forensic extractordrop onedrive %LOCALAPPDATA%\Microsoft\OneDrive · parse sync engine state + onedrive logs
- owncloud audit log forensic analyzerdrop owncloud audit log · parse file + share events
- pcloud desktop artifact forensic extractordrop pcloud drive cache · parse sync state
- proton drive artifact forensic extractordrop proton drive desktop data · parse sync + share cache
- qnap nas audit log forensic analyzerdrop qnap qts audit log · parse access events
- s3 access log forensic deep analyzerdrop s3 server access log · parse principal + action + object · detect anomalous bulk reads
- sync.com artifact forensic extractordrop sync.com desktop client data · parse sync + share state
- synology nas audit log forensic analyzerdrop synology dsm audit log export · parse access + share events
- tresorit artifact forensic extractordrop tresorit desktop client data · parse encrypted vault metadata
- truenas audit log forensic analyzerdrop truenas audit + middleware log · parse share access + administrative changes