ydkhatri / OneDrive

OneDrive log .ODL reader
https://swiftforensics.com
MIT License
121 stars 27 forks source link

Error with general.keystore #12

Closed hugoqribeiro closed 1 hour ago

hugoqribeiro commented 1 week ago

Great initiative, this script. :)

I'm trying to see my OneDrive personal account logs, running the script like this:

py odl.py -o C:\Temp\OD -s C:\Users\Hugo.Ribeiro\AppData\Local\Microsoft\OneDrive\logs\Personal\general.keystore C:\Users\Hugo.Ribeiro\AppData\Local\Microsoft\OneDrive\logs\Personal

I get this error:

  File "D:\GitHub\OneDrive\odl.py", line 599, in <module>
    main()
    ~~~~^^
  File "D:\GitHub\OneDrive\odl.py", line 550, in main
    map = read_obfuscation_map(obfuscation_map_path, args.all_key_values)
  File "D:\GitHub\OneDrive\odl.py", line 226, in read_obfuscation_map
    last_val += '\n' + line
    ^^^^^^^^
UnboundLocalError: cannot access local variable 'last_val' where it is not associated with a value

I'm no Python expert, but it looks to me that it is not handling the keys file correctly:

This is the contents of the file:

[{"CreatedTime" : 1732012173,"Key" : "9e4IEiW7JvMti96pk42A2LXQ5ZM\/8OMsj9utjzw5+2g=\u0000\u0000","Version" : 1}]

Or is it me doing something wrong?

ydkhatri commented 1 week ago

You don't need to specify the -s option. That option is only if you want to use the old ObfuscationStringmap.txt file. For .keystore files, it will automatically find them.

Just try this:

py odl.py -o C:\Temp\OD C:\Users\Hugo.Ribeiro\AppData\Local\Microsoft\OneDrive\logs\Personal