[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFPWZ0DCMXNANNKVCRJ6MG":3,"skill-same:01M6AFPWZ0DCMXNANNKVCRJ6MG":141},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":82,"commitSha":83,"skillDirectory":84,"forksCount":85,"repositoryHtmlUrl":86,"repositoryHomepageUrl":87,"ownerHtmlUrl":88,"ownerBlogUrl":89,"ownerDescription":90,"updatedAt":91,"install":92,"resources":105},"01M6AFPWZ0DCMXNANNKVCRJ6MG","performing-cloud-storage-forensic-acquisition",null,"Perform forensic acquisition of cloud storage services including Google Drive, OneDrive, Dropbox, and Box by pulling API-based remote data such as revision history and audit logs, and collecting local sync-client artifacts including KAPE targets and OneDrive databases from endpoints. Use during incident response or e-discovery when evidence resides in cloud-synced storage and both cloud-side and endpoint-side artifacts must be preserved.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-storage-forensic-acquisition\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48],"performing cloud storage forensic acquisition","storage","cloud","services","onedrive","google-drive","cloud-forensics","t1074","t1059","endpoint","digital-forensics","data","google","logs","audit","google drive","artifacts","sync","incident response","cybersecurity","2026-11-10 10:12:30",false,"---\nname: performing-cloud-storage-forensic-acquisition\ndescription: Perform forensic acquisition of cloud storage services including Google\n  Drive, OneDrive, Dropbox, and Box by pulling API-based remote data such as revision\n  history and audit logs, and collecting local sync-client artifacts including KAPE\n  targets and OneDrive databases from endpoints. Use during incident response or e-discovery\n  when evidence resides in cloud-synced storage and both cloud-side and endpoint-side\n  artifacts must be preserved.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- cloud-forensics\n- google-drive\n- onedrive\n- dropbox\n- box\n- cloud-acquisition\n- api-forensics\n- sync-client\n- endpoint-artifacts\n- magnet-axiom\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_ai_rmf:\n- MEASURE-2.7\n- MAP-5.1\n- MANAGE-2.4\natlas_techniques:\n- AML.T0070\n- AML.T0066\n- AML.T0082\nnist_csf:\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\nmitre_attack:\n- T1005\n- T1074\n- T1119\n- T1070\n- T1059\n---\n\n# Performing Cloud Storage Forensic Acquisition\n\n## Overview\n\nCloud storage forensic acquisition involves collecting digital evidence from services like Google Drive, OneDrive, Dropbox, and Box through both API-based remote acquisition and local endpoint artifact analysis. Modern investigations must address the challenge that cloud-synced files may exist in multiple states: locally synchronized, cloud-only (on-demand), cached, and deleted. Endpoint devices that have synchronized with cloud storage contain a wealth of metadata about locally synced files, files present only in the cloud, and even deleted items recoverable from cache folders. API-based acquisition using service-specific APIs provides direct access to remote data with valid credentials and proper legal authorization.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing cloud storage forensic acquisition\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Legal authorization (warrant, consent, or corporate policy) for cloud data access\n- Valid user credentials or administrative access tokens\n- Magnet AXIOM Cloud, Cellebrite Cloud Analyzer, or equivalent tool\n- KAPE with cloud storage target files\n- Python 3.8+ with google-api-python-client, msal, dropbox SDK\n- Network connectivity for API-based acquisition\n\n## Acquisition Methods\n\n### Method 1: API-Based Remote Acquisition\n\n#### Google Drive API Acquisition\n\n```python\nfrom google.oauth2.credentials import Credentials\nfrom googleapiclient.discovery import build\nfrom googleapiclient.http import MediaIoBaseDownload\nimport io\nimport os\nimport json\nfrom datetime import datetime\n\n\nclass GoogleDriveForensicAcquisition:\n    \"\"\"Forensically acquire files and metadata from Google Drive via API.\"\"\"\n\n    def __init__(self, credentials_path: str, output_dir: str):\n        self.creds = Credentials.from_authorized_user_file(credentials_path)\n        self.service = build(\"drive\", \"v3\", credentials=self.creds)\n        self.output_dir = output_dir\n        os.makedirs(output_dir, exist_ok=True)\n        self.acquisition_log = []\n\n    def list_all_files(self, include_trashed: bool = True) -> list:\n        \"\"\"List all files including trashed items.\"\"\"\n        files = []\n        page_token = None\n        query = \"\" if include_trashed else \"trashed = false\"\n\n        while True:\n            results = self.service.files().list(\n                q=query,\n                pageSize=1000,\n                fields=\"nextPageToken, files(id, name, mimeType, size, \"\n                       \"createdTime, modifiedTime, trashed, trashedTime, \"\n                       \"owners, sharingUser, permissions, md5Checksum, \"\n                       \"parents, webViewLink, driveId)\",\n                pageToken=page_token\n            ).execute()\n\n            files.extend(results.get(\"files\", []))\n            page_token = results.get(\"nextPageToken\")\n            if not page_token:\n                break\n\n        return files\n\n    def download_file(self, file_id: str, file_name: str, mime_type: str) -> str:\n        \"\"\"Download a file from Google Drive preserving forensic integrity.\"\"\"\n        output_path = os.path.join(self.output_dir, file_name)\n\n        if mime_type.startswith(\"application\u002Fvnd.google-apps\"):\n            export_formats = {\n                \"application\u002Fvnd.google-apps.document\": \"application\u002Fpdf\",\n                \"application\u002Fvnd.google-apps.spreadsheet\": \"application\u002Fvnd.openxmlformats-officedocument.spreadsheetml.sheet\",\n                \"application\u002Fvnd.google-apps.presentation\": \"application\u002Fpdf\",\n            }\n            export_mime = export_formats.get(mime_type, \"application\u002Fpdf\")\n            request = self.service.files().export_media(fileId=file_id, mimeType=export_mime)\n        else:\n            request = self.service.files().get_media(fileId=file_id)\n\n        with io.FileIO(output_path, \"wb\") as fh:\n            downloader = MediaIoBaseDownload(fh, request)\n            done = False\n            while not done:\n                _, done = downloader.next_chunk()\n\n        self.acquisition_log.append({\n            \"timestamp\": datetime.utcnow().isoformat(),\n            \"file_id\": file_id,\n            \"file_name\": file_name,\n            \"output_path\": output_path,\n            \"action\": \"downloaded\"\n        })\n        return output_path\n\n    def get_activity_log(self, file_id: str) -> list:\n        \"\"\"Retrieve activity\u002Frevision history for a specific file.\"\"\"\n        revisions = self.service.revisions().list(\n            fileId=file_id,\n            fields=\"revisions(id, modifiedTime, lastModifyingUser, size, md5Checksum)\"\n        ).execute()\n        return revisions.get(\"revisions\", [])\n\n    def export_acquisition_report(self) -> str:\n        \"\"\"Export acquisition log for chain of custody documentation.\"\"\"\n        report_path = os.path.join(self.output_dir, \"acquisition_log.json\")\n        with open(report_path, \"w\") as f:\n            json.dump({\n                \"acquisition_start\": self.acquisition_log[0][\"timestamp\"] if self.acquisition_log else None,\n                \"acquisition_end\": datetime.utcnow().isoformat(),\n                \"total_files\": len(self.acquisition_log),\n                \"entries\": self.acquisition_log\n            }, f, indent=2)\n        return report_path\n```\n\n#### OneDrive \u002F Microsoft 365 API Acquisition\n\n```python\nimport msal\nimport requests\nimport os\nimport json\nfrom datetime import datetime\n\n\nclass OneDriveForensicAcquisition:\n    \"\"\"Forensically acquire files and metadata from OneDrive via Microsoft Graph API.\"\"\"\n\n    def __init__(self, client_id: str, tenant_id: str, client_secret: str, output_dir: str):\n        self.output_dir = output_dir\n        os.makedirs(output_dir, exist_ok=True)\n\n        authority = f\"https:\u002F\u002Flogin.microsoftonline.com\u002F{tenant_id}\"\n        self.app = msal.ConfidentialClientApplication(\n            client_id, authority=authority, client_credential=client_secret\n        )\n        token_result = self.app.acquire_token_for_client(\n            scopes=[\"https:\u002F\u002Fgraph.microsoft.com\u002F.default\"]\n        )\n        self.access_token = token_result.get(\"access_token\")\n        self.headers = {\"Authorization\": f\"Bearer {self.access_token}\"}\n        self.base_url = \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\"\n\n    def list_user_files(self, user_id: str) -> list:\n        \"\"\"List all files in user's OneDrive.\"\"\"\n        url = f\"{self.base_url}\u002Fusers\u002F{user_id}\u002Fdrive\u002Froot\u002Fchildren\"\n        files = []\n        while url:\n            response = requests.get(url, headers=self.headers)\n            data = response.json()\n            files.extend(data.get(\"value\", []))\n            url = data.get(\"@odata.nextLink\")\n        return files\n\n    def download_file(self, user_id: str, item_id: str, filename: str) -> str:\n        \"\"\"Download a file from OneDrive.\"\"\"\n        url = f\"{self.base_url}\u002Fusers\u002F{user_id}\u002Fdrive\u002Fitems\u002F{item_id}\u002Fcontent\"\n        response = requests.get(url, headers=self.headers, stream=True)\n        output_path = os.path.join(self.output_dir, filename)\n        with open(output_path, \"wb\") as f:\n            for chunk in response.iter_content(chunk_size=8192):\n                f.write(chunk)\n        return output_path\n\n    def get_deleted_items(self, user_id: str) -> list:\n        \"\"\"Retrieve items from OneDrive recycle bin.\"\"\"\n        url = f\"{self.base_url}\u002Fusers\u002F{user_id}\u002Fdrive\u002Fspecial\u002Frecyclebin\u002Fchildren\"\n        response = requests.get(url, headers=self.headers)\n        return response.json().get(\"value\", [])\n```\n\n### Method 2: Local Endpoint Artifact Collection\n\n#### KAPE Targets for Cloud Storage\n\n```powershell\n# Collect all cloud storage artifacts using KAPE\nkape.exe --tsource C: --tdest C:\\Output\\CloudArtifacts --target GoogleDrive,OneDrive,Dropbox,Box\n\n# OneDrive artifacts\n# %USERPROFILE%\\AppData\\Local\\Microsoft\\OneDrive\\logs\\\n# %USERPROFILE%\\AppData\\Local\\Microsoft\\OneDrive\\settings\\\n# %USERPROFILE%\\OneDrive\\\n\n# Google Drive artifacts\n# %USERPROFILE%\\AppData\\Local\\Google\\DriveFS\\\n# Contains metadata SQLite databases and cached files\n\n# Dropbox artifacts\n# %USERPROFILE%\\AppData\\Local\\Dropbox\\\n# %USERPROFILE%\\Dropbox\\.dropbox.cache\\\n# Contains filecache.dbx (encrypted SQLite), host.dbx, config.dbx\n```\n\n#### OneDrive Local Database Analysis\n\n```python\nimport sqlite3\nimport os\n\ndef analyze_onedrive_sync_engine(db_path: str) -> list:\n    \"\"\"Analyze OneDrive SyncEngineDatabase for file metadata.\"\"\"\n    conn = sqlite3.connect(db_path)\n    cursor = conn.cursor()\n\n    # Query for all tracked files including cloud-only items\n    cursor.execute(\"\"\"\n        SELECT fileName, fileSize, lastChange,\n               resourceID, parentResourceID, eTag\n        FROM od_ClientFile_Records\n        ORDER BY lastChange DESC\n    \"\"\")\n\n    files = []\n    for row in cursor.fetchall():\n        files.append({\n            \"filename\": row[0],\n            \"size\": row[1],\n            \"last_change\": row[2],\n            \"resource_id\": row[3],\n            \"parent_id\": row[4],\n            \"etag\": row[5]\n        })\n\n    conn.close()\n    return files\n```\n\n## Cloud Storage Artifacts Summary\n\n| Service | Local Database | Cache Location | Log Files |\n|---------|---------------|----------------|-----------|\n| OneDrive | SyncEngineDatabase.db | %LOCALAPPDATA%\\Microsoft\\OneDrive\\cache\\ | %LOCALAPPDATA%\\Microsoft\\OneDrive\\logs\\ |\n| Google Drive | metadata_sqlite_db | %LOCALAPPDATA%\\Google\\DriveFS\\{account}\\content_cache\\ | %LOCALAPPDATA%\\Google\\DriveFS\\Logs\\ |\n| Dropbox | filecache.dbx (encrypted) | %APPDATA%\\Dropbox\\.dropbox.cache\\ | %APPDATA%\\Dropbox\\logs\\ |\n| Box | sync_db | %LOCALAPPDATA%\\Box\\Box\\cache\\ | %LOCALAPPDATA%\\Box\\Box\\logs\\ |\n\n## References\n\n- SANS Cloud Storage Acquisition: https:\u002F\u002Fwww.sans.org\u002Fblog\u002Fcloud-storage-acquisition-from-endpoint-devices\n- Magnet AXIOM Cloud: https:\u002F\u002Fwww.magnetforensics.com\u002Fblog\u002Fhow-to-acquire-and-analyze-cloud-data-with-magnet-axiom\u002F\n- AWS Cloud Forensics Framework: https:\u002F\u002Fdocs.aws.amazon.com\u002Fprescriptive-guidance\u002Flatest\u002Fsecurity-reference-architecture\u002Fcyber-forensics.html\n- API-Based Forensic Acquisition of Cloud Drives: https:\u002F\u002Farxiv.org\u002Fabs\u002F1603.06542\n\n## Example Output\n\n```text\n$ python3 cloud_forensic_acquire.py --provider google-drive --auth \u002Ftokens\u002Fgdrive_token.json \\\n    --user jsmith@corporate.com --output \u002Facquisition\u002Fgdrive\n\nCloud Storage Forensic Acquisition Tool v3.2\n==============================================\nProvider:    Google Drive\nAccount:     jsmith@corporate.com\nStart Time:  2024-01-19 08:00:15 UTC\nAuth Method: Admin SDK (domain-wide delegation)\n\n[+] Enumerating files...\n    Total files:        2,345\n    Total folders:      178\n    Shared with me:     456\n    Trashed items:      89 (included in acquisition)\n    Total size:         14.7 GB\n\n[+] Acquiring file contents...\n    Downloaded:    2,345 \u002F 2,345  [████████████████████████████████] 100%\n    Errors:        0\n    Elapsed:       18m 32s\n\n[+] Acquiring metadata...\n    File metadata:      2,345 entries\n    Revision history:   8,912 revisions across 1,234 files\n    Sharing permissions: 3,456 permission entries\n    Activity log:       12,345 events\n\n[+] Acquiring trashed items...\n    Recovered:     89 \u002F 89 items (234 MB)\n\n--- Acquisition Log ---\nTimestamp (UTC)          | Action           | File                                    | Size    | SHA-256\n2024-01-19 08:00:45      | Downloaded       | \u002FMy Drive\u002FFinance\u002FQ4_Report.xlsm        | 245 KB  | 7a3b8c9d...\n2024-01-19 08:00:46      | Downloaded       | \u002FMy Drive\u002FFinance\u002FBudget_2024.xlsx       | 1.2 MB  | 8b4c9d0e...\n...\n2024-01-19 08:02:12      | Trash-Recovered  | \u002FTrash\u002Femployee_list_full.csv            | 4.5 MB  | 9c5d0e1f...\n2024-01-19 08:02:13      | Trash-Recovered  | \u002FTrash\u002Fnetwork_diagram_v3.vsdx          | 2.1 MB  | 0d6e1f2a...\n2024-01-19 08:02:14      | Trash-Recovered  | \u002FTrash\u002Fcredentials_backup.kdbx          | 128 KB  | 1e7f2a3b...\n\n--- Sharing Analysis ---\nFiles Shared Externally:\n  \u002FMy Drive\u002FFinance\u002FQ4_Report.xlsm     → j.smith.personal8842@protonmail.com (2024-01-16 03:10 UTC)\n  \u002FMy Drive\u002FHR\u002Femployee_list_full.csv   → j.smith.personal8842@protonmail.com (2024-01-16 03:12 UTC)\n  \u002FMy Drive\u002FIT\u002Fnetwork_diagram_v3.vsdx  → anonymous (link sharing, 2024-01-16 03:15 UTC)\n\n--- Revision History (Suspicious) ---\nFile: \u002FMy Drive\u002FFinance\u002FQ4_Report.xlsm\n  Rev 1:  2024-01-10 09:00:00 UTC  (245 KB)  - Original\n  Rev 2:  2024-01-15 14:35:00 UTC  (248 KB)  - Modified (macro added)\n  Rev 3:  2024-01-16 03:05:00 UTC  (245 KB)  - Reverted (macro removed - anti-forensics)\n\nAcquisition Summary:\n  Files acquired:       2,345 (14.7 GB)\n  Trashed items:        89 (234 MB)\n  Revisions:            8,912\n  Chain of custody hash (full archive):\n    SHA-256: a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2\n  Output directory:     \u002Facquisition\u002Fgdrive\u002F\n  Acquisition log:      \u002Facquisition\u002Fgdrive\u002Facquisition_log.csv\n  Completion Time:      2024-01-19 08:18:47 UTC\n```\n","# Performing Cloud Storage Forensic Acquisition\n\n## Overview\n\nCloud storage forensic acquisition involves collecting digital evidence from services like Google Drive, OneDrive, Dropbox, and Box through both API-based remote acquisition and local endpoint artifact analysis. Modern investigations must address the challenge that cloud-synced files may exist in multiple states: locally synchronized, cloud-only (on-demand), cached, and deleted. Endpoint devices that have synchronized with cloud storage contain a wealth of metadata about locally synced files, files present only in the cloud, and even deleted items recoverable from cache folders. API-based acquisition using service-specific APIs provides direct access to remote data with valid credentials and proper legal authorization.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing cloud storage forensic acquisition\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Legal authorization (warrant, consent, or corporate policy) for cloud data access\n- Valid user credentials or administrative access tokens\n- Magnet AXIOM Cloud, Cellebrite Cloud Analyzer, or equivalent tool\n- KAPE with cloud storage target files\n- Python 3.8+ with google-api-python-client, msal, dropbox SDK\n- Network connectivity for API-based acquisition\n\n## Acquisition Methods\n\n### Method 1: API-Based Remote Acquisition\n\n#### Google Drive API Acquisition\n\n```python\nfrom google.oauth2.credentials import Credentials\nfrom googleapiclient.discovery import build\nfrom googleapiclient.http import MediaIoBaseDownload\nimport io\nimport os\nimport json\nfrom datetime import datetime\n\n\nclass GoogleDriveForensicAcquisition:\n    \"\"\"Forensically acquire files and metadata from Google Drive via API.\"\"\"\n\n    def __init__(self, credentials_path: str, output_dir: str):\n        self.creds = Credentials.from_authorized_user_file(credentials_path)\n        self.service = build(\"drive\", \"v3\", credentials=self.creds)\n        self.output_dir = output_dir\n        os.makedirs(output_dir, exist_ok=True)\n        self.acquisition_log = []\n\n    def list_all_files(self, include_trashed: bool = True) -> list:\n        \"\"\"List all files including trashed items.\"\"\"\n        files = []\n        page_token = None\n        query = \"\" if include_trashed else \"trashed = false\"\n\n        while True:\n            results = self.service.files().list(\n                q=query,\n                pageSize=1000,\n                fields=\"nextPageToken, files(id, name, mimeType, size, \"\n                       \"createdTime, modifiedTime, trashed, trashedTime, \"\n                       \"owners, sharingUser, permissions, md5Checksum, \"\n                       \"parents, webViewLink, driveId)\",\n                pageToken=page_token\n            ).execute()\n\n            files.extend(results.get(\"files\", []))\n            page_token = results.get(\"nextPageToken\")\n            if not page_token:\n                break\n\n        return files\n\n    def download_file(self, file_id: str, file_name: str, mime_type: str) -> str:\n        \"\"\"Download a file from Google Drive preserving forensic integrity.\"\"\"\n        output_path = os.path.join(self.output_dir, file_name)\n\n        if mime_type.startswith(\"application\u002Fvnd.google-apps\"):\n            export_formats = {\n                \"application\u002Fvnd.google-apps.document\": \"application\u002Fpdf\",\n                \"application\u002Fvnd.google-apps.spreadsheet\": \"application\u002Fvnd.openxmlformats-officedocument.spreadsheetml.sheet\",\n                \"application\u002Fvnd.google-apps.presentation\": \"application\u002Fpdf\",\n            }\n            export_mime = export_formats.get(mime_type, \"application\u002Fpdf\")\n            request = self.service.files().export_media(fileId=file_id, mimeType=export_mime)\n        else:\n            request = self.service.files().get_media(fileId=file_id)\n\n        with io.FileIO(output_path, \"wb\") as fh:\n            downloader = MediaIoBaseDownload(fh, request)\n            done = False\n            while not done:\n                _, done = downloader.next_chunk()\n\n        self.acquisition_log.append({\n            \"timestamp\": datetime.utcnow().isoformat(),\n            \"file_id\": file_id,\n            \"file_name\": file_name,\n            \"output_path\": output_path,\n            \"action\": \"downloaded\"\n        })\n        return output_path\n\n    def get_activity_log(self, file_id: str) -> list:\n        \"\"\"Retrieve activity\u002Frevision history for a specific file.\"\"\"\n        revisions = self.service.revisions().list(\n            fileId=file_id,\n            fields=\"revisions(id, modifiedTime, lastModifyingUser, size, md5Checksum)\"\n        ).execute()\n        return revisions.get(\"revisions\", [])\n\n    def export_acquisition_report(self) -> str:\n        \"\"\"Export acquisition log for chain of custody documentation.\"\"\"\n        report_path = os.path.join(self.output_dir, \"acquisition_log.json\")\n        with open(report_path, \"w\") as f:\n            json.dump({\n                \"acquisition_start\": self.acquisition_log[0][\"timestamp\"] if self.acquisition_log else None,\n                \"acquisition_end\": datetime.utcnow().isoformat(),\n                \"total_files\": len(self.acquisition_log),\n                \"entries\": self.acquisition_log\n            }, f, indent=2)\n        return report_path\n```\n\n#### OneDrive \u002F Microsoft 365 API Acquisition\n\n```python\nimport msal\nimport requests\nimport os\nimport json\nfrom datetime import datetime\n\n\nclass OneDriveForensicAcquisition:\n    \"\"\"Forensically acquire files and metadata from OneDrive via Microsoft Graph API.\"\"\"\n\n    def __init__(self, client_id: str, tenant_id: str, client_secret: str, output_dir: str):\n        self.output_dir = output_dir\n        os.makedirs(output_dir, exist_ok=True)\n\n        authority = f\"https:\u002F\u002Flogin.microsoftonline.com\u002F{tenant_id}\"\n        self.app = msal.ConfidentialClientApplication(\n            client_id, authority=authority, client_credential=client_secret\n        )\n        token_result = self.app.acquire_token_for_client(\n            scopes=[\"https:\u002F\u002Fgraph.microsoft.com\u002F.default\"]\n        )\n        self.access_token = token_result.get(\"access_token\")\n        self.headers = {\"Authorization\": f\"Bearer {self.access_token}\"}\n        self.base_url = \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\"\n\n    def list_user_files(self, user_id: str) -> list:\n        \"\"\"List all files in user's OneDrive.\"\"\"\n        url = f\"{self.base_url}\u002Fusers\u002F{user_id}\u002Fdrive\u002Froot\u002Fchildren\"\n        files = []\n        while url:\n            response = requests.get(url, headers=self.headers)\n            data = response.json()\n            files.extend(data.get(\"value\", []))\n            url = data.get(\"@odata.nextLink\")\n        return files\n\n    def download_file(self, user_id: str, item_id: str, filename: str) -> str:\n        \"\"\"Download a file from OneDrive.\"\"\"\n        url = f\"{self.base_url}\u002Fusers\u002F{user_id}\u002Fdrive\u002Fitems\u002F{item_id}\u002Fcontent\"\n        response = requests.get(url, headers=self.headers, stream=True)\n        output_path = os.path.join(self.output_dir, filename)\n        with open(output_path, \"wb\") as f:\n            for chunk in response.iter_content(chunk_size=8192):\n                f.write(chunk)\n        return output_path\n\n    def get_deleted_items(self, user_id: str) -> list:\n        \"\"\"Retrieve items from OneDrive recycle bin.\"\"\"\n        url = f\"{self.base_url}\u002Fusers\u002F{user_id}\u002Fdrive\u002Fspecial\u002Frecyclebin\u002Fchildren\"\n        response = requests.get(url, headers=self.headers)\n        return response.json().get(\"value\", [])\n```\n\n### Method 2: Local Endpoint Artifact Collection\n\n#### KAPE Targets for Cloud Storage\n\n```powershell\n# Collect all cloud storage artifacts using KAPE\nkape.exe --tsource C: --tdest C:\\Output\\CloudArtifacts --target GoogleDrive,OneDrive,Dropbox,Box\n\n# OneDrive artifacts\n# %USERPROFILE%\\AppData\\Local\\Microsoft\\OneDrive\\logs\\\n# %USERPROFILE%\\AppData\\Local\\Microsoft\\OneDrive\\settings\\\n# %USERPROFILE%\\OneDrive\\\n\n# Google Drive artifacts\n# %USERPROFILE%\\AppData\\Local\\Google\\DriveFS\\\n# Contains metadata SQLite databases and cached files\n\n# Dropbox artifacts\n# %USERPROFILE%\\AppData\\Local\\Dropbox\\\n# %USERPROFILE%\\Dropbox\\.dropbox.cache\\\n# Contains filecache.dbx (encrypted SQLite), host.dbx, config.dbx\n```\n\n#### OneDrive Local Database Analysis\n\n```python\nimport sqlite3\nimport os\n\ndef analyze_onedrive_sync_engine(db_path: str) -> list:\n    \"\"\"Analyze OneDrive SyncEngineDatabase for file metadata.\"\"\"\n    conn = sqlite3.connect(db_path)\n    cursor = conn.cursor()\n\n    # Query for all tracked files including cloud-only items\n    cursor.execute(\"\"\"\n        SELECT fileName, fileSize, lastChange,\n               resourceID, parentResourceID, eTag\n        FROM od_ClientFile_Records\n        ORDER BY lastChange DESC\n    \"\"\")\n\n    files = []\n    for row in cursor.fetchall():\n        files.append({\n            \"filename\": row[0],\n            \"size\": row[1],\n            \"last_change\": row[2],\n            \"resource_id\": row[3],\n            \"parent_id\": row[4],\n            \"etag\": row[5]\n        })\n\n    conn.close()\n    return files\n```\n\n## Cloud Storage Artifacts Summary\n\n| Service | Local Database | Cache Location | Log Files |\n|---------|---------------|----------------|-----------|\n| OneDrive | SyncEngineDatabase.db | %LOCALAPPDATA%\\Microsoft\\OneDrive\\cache\\ | %LOCALAPPDATA%\\Microsoft\\OneDrive\\logs\\ |\n| Google Drive | metadata_sqlite_db | %LOCALAPPDATA%\\Google\\DriveFS\\{account}\\content_cache\\ | %LOCALAPPDATA%\\Google\\DriveFS\\Logs\\ |\n| Dropbox | filecache.dbx (encrypted) | %APPDATA%\\Dropbox\\.dropbox.cache\\ | %APPDATA%\\Dropbox\\logs\\ |\n| Box | sync_db | %LOCALAPPDATA%\\Box\\Box\\cache\\ | %LOCALAPPDATA%\\Box\\Box\\logs\\ |\n\n## References\n\n- SANS Cloud Storage Acquisition: https:\u002F\u002Fwww.sans.org\u002Fblog\u002Fcloud-storage-acquisition-from-endpoint-devices\n- Magnet AXIOM Cloud: https:\u002F\u002Fwww.magnetforensics.com\u002Fblog\u002Fhow-to-acquire-and-analyze-cloud-data-with-magnet-axiom\u002F\n- AWS Cloud Forensics Framework: https:\u002F\u002Fdocs.aws.amazon.com\u002Fprescriptive-guidance\u002Flatest\u002Fsecurity-reference-architecture\u002Fcyber-forensics.html\n- API-Based Forensic Acquisition of Cloud Drives: https:\u002F\u002Farxiv.org\u002Fabs\u002F1603.06542\n\n## Example Output\n\n```text\n$ python3 cloud_forensic_acquire.py --provider google-drive --auth \u002Ftokens\u002Fgdrive_token.json \\\n    --user jsmith@corporate.com --output \u002Facquisition\u002Fgdrive\n\nCloud Storage Forensic Acquisition Tool v3.2\n==============================================\nProvider:    Google Drive\nAccount:     jsmith@corporate.com\nStart Time:  2024-01-19 08:00:15 UTC\nAuth Method: Admin SDK (domain-wide delegation)\n\n[+] Enumerating files...\n    Total files:        2,345\n    Total folders:      178\n    Shared with me:     456\n    Trashed items:      89 (included in acquisition)\n    Total size:         14.7 GB\n\n[+] Acquiring file contents...\n    Downloaded:    2,345 \u002F 2,345  [████████████████████████████████] 100%\n    Errors:        0\n    Elapsed:       18m 32s\n\n[+] Acquiring metadata...\n    File metadata:      2,345 entries\n    Revision history:   8,912 revisions across 1,234 files\n    Sharing permissions: 3,456 permission entries\n    Activity log:       12,345 events\n\n[+] Acquiring trashed items...\n    Recovered:     89 \u002F 89 items (234 MB)\n\n--- Acquisition Log ---\nTimestamp (UTC)          | Action           | File                                    | Size    | SHA-256\n2024-01-19 08:00:45      | Downloaded       | \u002FMy Drive\u002FFinance\u002FQ4_Report.xlsm        | 245 KB  | 7a3b8c9d...\n2024-01-19 08:00:46      | Downloaded       | \u002FMy Drive\u002FFinance\u002FBudget_2024.xlsx       | 1.2 MB  | 8b4c9d0e...\n...\n2024-01-19 08:02:12      | Trash-Recovered  | \u002FTrash\u002Femployee_list_full.csv            | 4.5 MB  | 9c5d0e1f...\n2024-01-19 08:02:13      | Trash-Recovered  | \u002FTrash\u002Fnetwork_diagram_v3.vsdx          | 2.1 MB  | 0d6e1f2a...\n2024-01-19 08:02:14      | Trash-Recovered  | \u002FTrash\u002Fcredentials_backup.kdbx          | 128 KB  | 1e7f2a3b...\n\n--- Sharing Analysis ---\nFiles Shared Externally:\n  \u002FMy Drive\u002FFinance\u002FQ4_Report.xlsm     → j.smith.personal8842@protonmail.com (2024-01-16 03:10 UTC)\n  \u002FMy Drive\u002FHR\u002Femployee_list_full.csv   → j.smith.personal8842@protonmail.com (2024-01-16 03:12 UTC)\n  \u002FMy Drive\u002FIT\u002Fnetwork_diagram_v3.vsdx  → anonymous (link sharing, 2024-01-16 03:15 UTC)\n\n--- Revision History (Suspicious) ---\nFile: \u002FMy Drive\u002FFinance\u002FQ4_Report.xlsm\n  Rev 1:  2024-01-10 09:00:00 UTC  (245 KB)  - Original\n  Rev 2:  2024-01-15 14:35:00 UTC  (248 KB)  - Modified (macro added)\n  Rev 3:  2024-01-16 03:05:00 UTC  (245 KB)  - Reverted (macro removed - anti-forensics)\n\nAcquisition Summary:\n  Files acquired:       2,345 (14.7 GB)\n  Trashed items:        89 (234 MB)\n  Revisions:            8,912\n  Chain of custody hash (full archive):\n    SHA-256: a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2\n  Output directory:     \u002Facquisition\u002Fgdrive\u002F\n  Acquisition log:      \u002Facquisition\u002Fgdrive\u002Facquisition_log.csv\n  Completion Time:      2024-01-19 08:18:47 UTC\n```\n",{"name":5,"tags":54,"author":62,"domain":48,"license":15,"version":63,"nist_csf":64,"subdomain":39,"description":7,"nist_ai_rmf":68,"mitre_attack":72,"atlas_techniques":78},[35,34,33,55,56,57,58,59,60,61],"dropbox","box","cloud-acquisition","api-forensics","sync-client","endpoint-artifacts","magnet-axiom","mahipal","1.0",[65,66,67],"RS.AN-03","DE.AE-02","RS.MA-01",[69,70,71],"MEASURE-2.7","MAP-5.1","MANAGE-2.4",[73,74,75,76,77],"T1005","T1074","T1119","T1070","T1059",[79,80,81],"AML.T0070","AML.T0066","AML.T0082","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-cloud-storage-forensic-acquisition",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":93,"prompt":103,"zipAvailable":104},[94,97,100],{"tool":95,"command":96},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-cloud-storage-forensic-acquisition",{"tool":98,"command":99},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-cloud-storage-forensic-acquisition",{"tool":101,"command":102},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-cloud-storage-forensic-acquisition","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-storage-forensic-acquisition\u002FSKILL.md",true,[106,112,117,123,127,131,137],{"path":107,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":110,"sourceHtmlUrl":111},"assets\u002Ftemplate.md","ASSET","资产文件",556,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-storage-forensic-acquisition\u002Fassets\u002Ftemplate.md",{"path":113,"resourceType":113,"resourceTypeDesc":114,"sizeBytes":115,"sourceHtmlUrl":116},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-storage-forensic-acquisition\u002FLICENSE",{"path":118,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":121,"sourceHtmlUrl":122},"references\u002Fapi-reference.md","REFERENCE","参考文档",6146,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-storage-forensic-acquisition\u002Freferences\u002Fapi-reference.md",{"path":124,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":125,"sourceHtmlUrl":126},"references\u002Fstandards.md",784,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-storage-forensic-acquisition\u002Freferences\u002Fstandards.md",{"path":128,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":129,"sourceHtmlUrl":130},"references\u002Fworkflows.md",824,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-storage-forensic-acquisition\u002Freferences\u002Fworkflows.md",{"path":132,"resourceType":133,"resourceTypeDesc":134,"sizeBytes":135,"sourceHtmlUrl":136},"scripts\u002Fagent.py","SCRIPT","脚本",10800,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-storage-forensic-acquisition\u002Fscripts\u002Fagent.py",{"path":138,"resourceType":133,"resourceTypeDesc":134,"sizeBytes":139,"sourceHtmlUrl":140},"scripts\u002Fprocess.py",4962,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-storage-forensic-acquisition\u002Fscripts\u002Fprocess.py",[142,169,193,221,244,271],{"skillNo":143,"name":144,"nameZh":6,"description":145,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":146,"categories":147,"keywords":151,"publishedAt":49},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[148],{"categoryNo":149,"categoryName":150,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[152,153,154,155,156,48,47,157,158,159,45,160,161,162,163,164,165,166,167,168],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","identity","pr","code","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":170,"name":171,"nameZh":6,"description":172,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":173,"categories":174,"keywords":176,"publishedAt":49},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[175],{"categoryNo":149,"categoryName":150,"taxonomyType":21,"taxonomyTypeDesc":22},[177,165,178,179,156,180,48,158,181,182,183,184,185,186,187,188,189,190,191,192],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":194,"name":195,"nameZh":6,"description":196,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":197,"categories":198,"keywords":203,"publishedAt":49},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[199,202],{"categoryNo":200,"categoryName":201,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":149,"categoryName":150,"taxonomyType":21,"taxonomyTypeDesc":22},[187,204,205,206,207,48,208,209,181,210,211,212,213,214,215,216,217,218,219,220],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":222,"name":223,"nameZh":6,"description":224,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":225,"categories":226,"keywords":228,"publishedAt":49},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[227],{"categoryNo":149,"categoryName":150,"taxonomyType":21,"taxonomyTypeDesc":22},[229,230,231,48,232,233,42,234,235,236,237,40,238,239,39,240,184,241,242,243],"windows","kape","triaging windows with kape","registry","browser","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","SET","collection","pecmd","artifact-collection",{"skillNo":245,"name":246,"nameZh":6,"description":247,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":248,"categories":249,"keywords":251,"publishedAt":49},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[250],{"categoryNo":149,"categoryName":150,"taxonomyType":21,"taxonomyTypeDesc":22},[252,253,254,48,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":272,"name":273,"nameZh":6,"description":274,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":275,"categories":276,"keywords":278,"publishedAt":49},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[277],{"categoryNo":149,"categoryName":150,"taxonomyType":21,"taxonomyTypeDesc":22},[156,279,48,280,281,282,283,284,285,286,287,216,288,217,289,290,291,292,293,294],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]