OneDrive — Let’s Take This Offline

Microsoft OneDrive Offline Mode stores significantly more than synchronized files. Modern versions of the client cache data from Outlook, Microsoft Teams, and SharePoint, creating a rich source of forensic evidence that is often absent from traditional acquisition and analysis workflows. Investigators who understand these artifacts can recover valuable context about user activity even when cloud access is unavailable. This session provides a deep technical examination of OneDrive Offline Mode artifacts and demonstrates how to identify and analyze files associated with email, calendar events, meeting invitations, Teams chats, and SharePoint data. The presentation explains where these artifacts are stored, how they relate to one another, and techniques for reconstructing user activity across Microsoft 365 services. The session also examines OneDrive's Optical Character Recognition (OCR) metadata, showing how text extracted from images and documents can become valuable investigative evidence while also introducing privacy and security considerations. Attendees will learn how OCR data is stored, what information can be recovered, and the implications for incident response, insider threat investigations, and enterprise data protection. Using real artifacts and practical demonstrations, attendees will gain a repeatable methodology for locating, parsing, and correlating OneDrive Offline Mode data. They will leave with actionable techniques that can be immediately incorporated into forensic collections, artifact triage, and Microsoft 365 investigations.