performing-cloud-storage-forensic-acquisition
Perform forensic acquisition of cloud storage services including Google Drive, OneDrive, Dropbox, and Box by pulling API-based remote data such as revision history and audit logs, and collecting local sync-client artifacts including KAPE targets and OneDrive databases from endpoints. Use during incident response or e-discovery when evidence resides in cloud-synced storage and both cloud-side and endpoint-side artifacts must be preserved.
SKILL.md
The description above is the indexed summary. With JavaScript enabled, this page also loads the SKILL.md text from GitHub.