amgdgocha/drivefs-sleuth

DriveFS Sleuth is a Python tool that automates investigating Google Drive File Stream disk artifacts, the tool has been developed based on research that has been performed by mounting different scenarios and noting down the changes in the Google Drive File Stream disk artifacts.

Hi , I'm Amged

A blue-teamer who enjoys reverse engineering malware, detecting and hunting for cyber threats, and performing DFIR to respond to cyber security incidents. 🕵 👾

---

📝 I regularly write articles on https://amgedwageh.medium.com/
📄 Know about my experiences https://www.linkedin.com/in/amgedwageh
📫 How to reach me [email protected]

Blogs posts

• DriveFS Sleuth — Revealing The Hidden Intelligence
• DriveFS Sleuth — Your Ultimate Google Drive File Stream Investigator!
• Pillars of Analyzing Malicious MS Office Documents — Part 1–3: Unveiling Document Format Structures
• Analysis Of An AutoIT Script That Wraps A Remcos RAT
• LockBit Ransomware Analysis Notes

Statistics

Connect with me:

drivefs-sleuth's Issues

error if the target file is deleted

Handle when the target item of a Link is not available.

Issue with dependencies

ERROR: Could not build wheels for grpcio-tools, which is required to install pyproject.toml-based projects

Got this after running pip install -r requirements.txt on a Windows 11 command prompt. The python script won't execute correctly without this. I have the 2022 Dev Tools installed as well. Any workaround for this or seen anyone with similar errors? Thanks!

make sure that the user is specifying csv or html output formats

make sure that the user is specifying csv or html output formats.

Reported By: Chad Tilbury

applying_error_handling_and_backward_compatibility

Some artifacts are missing in the older versions of Google Drive File Stream due to newly added features on the new versions. Propper error handling needs to be applied along with backward compatibility enhancements.

Reported by: Chad Tilbury

The respective data have been submitted privately.

recovering the files from the content cache

• recover the cached files from the content cache.
• update the command line arguments respectively to support the following.
  • recover the cached files only if specified by the command line arguments.
  • support to only recover the files that appear in the search results.
• update the README.md file accordingly.