Forensic Analysis of OneDrive Synchronization Artifacts in Windows Operating Systems

Cloud storage services such as Microsoft OneDrive are widely used in modern computing environments, making them an important source of digital evidence during forensic investigations. However, the proprietary nature of OneDrive synchronization mechanisms and the absence of explicit user-action logs pose significant challenges for accurate forensic analysis. This study examines OneDrive synchronization artifacts generated on Windows operating systems by performing controlled user actions and analyzing the resulting client-side forensic artifacts. A structured experimental methodology was adopted to correlate local file system activities with OneDrive client logs to reconstruct synchronization behavior. The analysis demonstrates that OneDrive synchronization activity can be reliably reconstructed by identifying and correlating distinct synchronization cycles, even in the absence of explicit file-level logs. The findings highlight the forensic significance of OneDrive client logs and provide practical insights for investigators analyzing cloud synchronization activity on Windows systems.