search

AmgdGocha / DriveFS-Sleuth

DriveFS Sleuth is a Python tool that automates investigating Google Drive File Stream disk artifacts, the tool has been developed based on research that has been performed by mounting different scenarios and noting down the changes in the Google Drive File Stream disk artifacts.
https://pypi.org/project/drivefs-sleuth/
Eclipse Public License 2.0
73 stars 3 forks source link
drive-file-stream exfiltration forensics google-drive unauthorized-application

readme

Google Drive For Desktop - What is it?

Google Drive for Desktop (formerly known as Google Drive File Stream) works as a file-syncing application, facilitating the synchronization of files and photos with Google Drive and Google Photos services. The nomenclature "file stream" is attributed to its capability to stream files on demand, thereby avoiding the need to occupy disk space by downloading all files preemptively. Upon installation and login, users can promptly access all previously synced files through Windows Explorer, without the necessity of storing an offline version.

🕵️ DriveFS Sleuth

This is how Bing creator imagined a logo for the DriveFS Sleuth Tool.

DriveFS Sleuth is a Python tool that automates investigating Google Drive File Stream disk artifacts, the tool has been developed based on research that has been performed by mounting different scenarios and noting down the changes in the Google Drive File Stream disk artifacts.

🚀 DriveFS Sleuth is capable of:

For the underlying research, refer to:

🔍 Artifacts Collection Made Easy

For those who are fans of Velociraptor, like myself, here is a Velociraptor offline collector ready to be used for triaging Google Drive File Stream artifacts to investigate them. The collector can be found here https://github.com/AmgdGocha/DriveFS-Sleuth/tree/main/collectors.

You can also use this Kape target to gather the same artifacts: https://github.com/EricZimmerman/KapeFiles/blob/master/Targets/Apps/GoogleDrive_Metadata.tkape

⚙️ Installation

DriveFS Sleuth can be easily installed using pip. https://pypi.org/project/drivefs-sleuth/

pip install drivefs-sleuth

It also can be directly used from the source code by:

  1. Clone the repo 
    git clone https://github.com/AmgdGocha/DriveFS-Sleuth.git
  2. Optionally, Inside the downloaded folder, create a new virtual environment 
    python -m venv drivefs_sleuth
    • Activate the virtual environment:
    • On windows: 
      .\drivefs_sleuth\Scripts\activate
    • On Linux and macOS 
      source drivefs_sleuth/bin/activate
  3. Install Dependencies 
    pip install -r requirements.txt

🧑‍💻 DriveFS Sleuth Usage

usage: DriveFS Sleuth [-h] -o OUTPUT [--accounts ACCOUNTS [ACCOUNTS ...]]
                      [--regex REGEX [REGEX ...]]
                      [-q QUERY_BY_NAME [QUERY_BY_NAME ...]]
                      [--md5 MD5 [MD5 ...]] [--search-csv SEARCH_CSV]
                      [--exact] [--dont-list-sub-items] [--csv] [--html]
                      [--recover-from-cache | --recover-search-results]
                      path

██████╗ ██████╗ ██╗██╗   ██╗███████╗███████╗███████╗    ███████╗██╗     ███████╗██╗   ██╗████████╗██╗  ██╗
██╔══██╗██╔══██╗██║██║   ██║██╔════╝██╔════╝██╔════╝    ██╔════╝██║     ██╔════╝██║   ██║╚══██╔══╝██║  ██║
██║  ██║██████╔╝██║██║   ██║█████╗  █████╗  ███████╗    ███████╗██║     █████╗  ██║   ██║   ██║   ███████║
██║  ██║██╔══██╗██║╚██╗ ██╔╝██╔══╝  ██╔══╝  ╚════██║    ╚════██║██║     ██╔══╝  ██║   ██║   ██║   ██╔══██║
██████╔╝██║  ██║██║ ╚████╔╝ ███████╗██║     ███████║    ███████║███████╗███████╗╚██████╔╝   ██║   ██║  ██║
╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═══╝  ╚══════╝╚═╝     ╚══════╝    ╚══════╝╚══════╝╚══════╝ ╚═════╝    ╚═╝   ╚═╝  ╚═╝
               A tool for investigating Google Drive File Stream's disk forensic artifacts.

                                           By: Amged Wageh
                                         Twitter: @amgdgocha
                                   GitHub: https://github.com/AmgdGocha
                                  Medium: https://medium.com/@amgedwageh
                             Linked In: https://www.linkedin.com/in/amgedwageh

positional arguments:
  path                  A path to the DriveFS folder. By default on a live system, it should exist in %LocalAppData%\Google\DriveFS.

options:
  -h, --help            show this help message and exit
  -o OUTPUT, --output OUTPUT
                        A path to a directory to save the output.
  --accounts ACCOUNTS [ACCOUNTS ...]
                        Specifies account id/s or emails separated by space to be processed, defaults to all the accounts.

Searching Arguments:
  --regex REGEX [REGEX ...]
                        Searches for files or folders by regular expressions. Multiple regex can be passed separated by spaces.
  -q QUERY_BY_NAME [QUERY_BY_NAME ...], --query-by-name QUERY_BY_NAME [QUERY_BY_NAME ...]
                        Searches for files or folders by name. The search will be case insensitive. Multiple file names can be passed separated by spaces.
  --md5 MD5 [MD5 ...]   Searches for files by the MD5 hash. Multiple hashes can be passed separated by spaces.
  --search-csv SEARCH_CSV
                        Searches for files or folders that satisfies the searching conditions in the provided CSV file.
  --exact               If selected, only files or folders with exact file names will be returned. The --query_by_name argument has to be passed. Defaults to False.
  --dont-list-sub-items
                        By default, if a folder matches the search criteria, the results will contain all of it's sub-items. This argument suppresses this feature to only return the folder without listing it's sub-items.

Output Formats:
  --csv                 Generates a CSV report. The CSV report will only contain information about the files and folders. Either --csv or --html should be specified.
  --html                Generates an HTML report. The HTML report contains comprehensive information about the analyzed artifacts.  Either --csv or --html should be specified.

Recovery Options:
  --recover-from-cache  Recover the cached items from the content cache.
  --recover-search-results
                        Recover the search results items that are cached.

Automated Investigation

Easily automate the examination of Google Drive File Stream artifacts by providing the tool with the path to the DriveFS triaged folder.

Targeted Analysis

Utilize the --accounts argument to specify the email or account ID of the targeted account, allowing the tool to process specific accounts of interest. Multiple accounts can be specified, separated by spaces. Defaults to all available accounts.

Flexible Search Functionality

DriveFS Sleuth supports various search functionalities to meet your investigative needs:

Customization Options

Tailor the tool's behavior with additional parameters:

Recovery From Cache

Drive Sleuth can parse and recover the cached synced items and their thumbnails if available, the recovery path will be under a subdirectory with the account name/email that will be created under the output path passed via the [-o|--output] argument. Only the search results will be recovered if the argument --recover-search-results is set.

Output Options

DriveFS Sleuth provides support for two types of outputs:

  1. CSV Files: Can be specified via the --csv argument to instruct DriveFS Sleuth to generate two CSV files. The first CSV file includes a comprehensive list of all processed files, while the second CSV file specifically enumerates files and folders that match the search criteria if provided by the analyst.
  2. HTML Report: Can be specified via the --html argument to instruct DriveFS Sleuth to generate an HTML report summarizing the analysis results. The reports will be created under the output directory passed via the [-o|--output] argument.

Examples

The following are some examples of the tool usage, change the paths and the searching criteria to match yours.

📰 Featured At:

🌟 Your Feedback Matters:

I'm eager to hear your thoughts! Share your feedback and suggestions, or report issues on our GitHub repository. Your input is crucial in making DriveFS Sleuth even more robust. Consider starring the repo if you found it useful. 😉