Reading OneDrive Logs

Last modified: 2023-08-18


OneDrive log files can be read by deobfuscating.

Deobfuscating Log Files

To read OneDrive logs, we need to deobfuscate log files (.odl, .odlsent, .odlgz).
These logs are located in the following on Windows:

  • C:\Users\<username>\AppData\Local\Microsoft\OneDrive\logs\Personal\
  • C:\Users\<username>\AppData\Local\Microsoft\OneDrive\logs\Business1\

This repository is useful to deobfuscate OneDrive logs.

python -m venv venv
# on Windows
pip install construct pycryptodome
python -o .\output.csv c:\Users\\AppData\Local\Microsoft\OneDrive\logs\Personal\

After that, we can read the output file (output.csv) with tools such as VS Code and Excel.
This file contains sensitive information such as OneDrive account email, access token, etc.