onedrive personal artifact forensic extractor — free browser tool | fatcousin

drop onedrive %LOCALAPPDATA%\\Microsoft\\OneDrive · parse sync engine state + onedrive logs

input

drop SyncEngineDatabase.db · settings json · odl logs · zip export

onedrive folder export · per-file heuristic parse

Select file

flags personal vault refs · shared link cache · sync pause · large delete batches · off-hours · actor spikes · bulk destructive

limits

heuristic screener · client/export format varies — sqlite schema and odl layout differ by onedrive version · not definitive proof

status

>ready