OneDrive Logs

OneDrive log files can be read by deobfuscating.

Deobfuscating Log Files

To read OneDrive logs, we need to deobfuscate log files (.odl, .odlsent, .odlgz). These logs are located in the following on Windows:

• C:\Users\<username>\AppData\Local\Microsoft\OneDrive\logs\Personal\

• C:\Users\<username>\AppData\Local\Microsoft\OneDrive\logs\Business1\

This repository is useful to deobfuscate OneDrive logs.

python -m venv venv
# on Windows
.\venv\Scripts\activate
pip install construct pycryptodome
python odl.py -o .\output.csv c:\Users\\AppData\Local\Microsoft\OneDrive\logs\Personal\

After that, we can read the output file (output.csv) with tools such as VS Code and Excel. This file contains sensitive information such as OneDrive account email, access token, etc.