iiinova — where your digital self keeps evolving

beercow.bsky.social @beercow.bsky.social · 04/09/2026

OneDrive now records volume id, drive letter, and volume name of removable devices. So much winning.

000

beercow.bsky.social @beercow.bsky.social · 20/08/2026

OneDriveExplorer is getting thumbnails in a future release!

000

beercow.bsky.social @beercow.bsky.social · 20/08/2026

OneDriveExplorer is getting thumbnails in a future release!

010

beercow.bsky.social @beercow.bsky.social · 20/08/2026

OneDriveExplorer is getting thumbnails in a future release!

000

beercow.bsky.social @beercow.bsky.social · 20/08/2026

OneDriveExplorer is getting thumbnails in a future release!

000

beercow.bsky.social @beercow.bsky.social · 20/08/2026

OneDriveExplorer is getting thumbnails in a future release!

000

beercow.bsky.social @beercow.bsky.social · 04/08/2026

Looks like Offline Mode is being added to OneDrive Personal.

000

beercow.bsky.social @beercow.bsky.social · 04/08/2026

Thumbnails started appetin OneDrive Databases.

000

beercow.bsky.social @beercow.bsky.social · 09/04/2026

Coming soon. How to build a combined Fuji recovery and WinFE drive. #DFIR

000

beercow.bsky.social @beercow.bsky.social · 07/04/2026

Coming soon. How to build a combined Fuji recovery and WinFE drive. #DFIR

001

beercow.bsky.social @beercow.bsky.social · 21/03/2026

SmackThatHash features AmCache SHA1 variant and QuickXorHash (OneDrive). Run against a single file or entire folder recursively. Pick from preset hashes or roll your own. Console and csv output. #DFIR github.com/Beercow/Smac...

github.com

GitHub - Beercow/SmackThatHash: Hashing utility including AmCache SHA1 and QuickXorHash · GitHub

Hashing utility including AmCache SHA1 and QuickXorHash - Beercow/SmackThatHash

100

beercow.bsky.social @beercow.bsky.social · 06/03/2026

Made an update to XstReader. It was unusable with larger ost files. It now loads large ost files in seconds making it usable again. Have a pull request in but not counting on it being accepted due to inactivity. Let me know what you think. #DFIR github.com/Beercow/XstR...

github.com

Releases · Beercow/XstReader

XstReader is an open source viewer for Microsoft Outlook’s .ost and .pst files (also those protected by unknown password). You can view and inspect all content and export messages and attachments (...

000

beercow.bsky.social @beercow.bsky.social · 22/12/2025

When you get a group text and fix the name and picture for them.

010

beercow.bsky.social @beercow.bsky.social · 07/12/2025

Fixed a bug in DeXRAY for Windows Defender files. 🙂 www.hexacorn.com/blog/2025/12...

000

beercow.bsky.social @beercow.bsky.social · 03/12/2025

Fixed a bug in DeXRAY for Windows Defender files. 🙂 www.hexacorn.com/blog/2025/12...

000

Reposted by @beercow.bsky.social

DFIR Diva @dfirdiva.bsky.social · 01/12/2025

📢 I partnered with @13cubed.bsky.social for another giveaway! 🎁 🏆 1 winner will receive a 13Cubed Investigator T-Shirt + the XPlat Bundle Complete 👕 5 winners will receive 13Cubed Investigator T-Shirts To Enter: Like, Comment, and Repost #DFIR #DigitalForensics #IncidentResponse

9108

beercow.bsky.social @beercow.bsky.social · 20/11/2025

Not that kind of consent. The UAC kind of consent. Take a dive into how UAC works and some of the things it doesn’t tell you. Also a new utility to solve some of these issues. malwaremaloney.blogspot.com/2025/11/lets...

malwaremaloney.blogspot.com

MALoney (It's in the name): Let's Talk About Consent

User Account Control (UAC) is one of Windows’ core security features, designed to prevent applications from silently gaini...

000

Reposted by @beercow.bsky.social

beercow.bsky.social @beercow.bsky.social · 20/11/2025

When launching a program as admin, consent.exe runs with a parent process of svchost. If successful, consent.exe exits and the new process is launched with explorer as its parent. If not, we can’t always tell what was trying to be ran. Until now. github.com/Beercow/Cons...

021

beercow.bsky.social @beercow.bsky.social · 20/11/2025

021

beercow.bsky.social @beercow.bsky.social · 19/11/2025

Into the unknown and down rabbit holes we go.

000

Reposted by @beercow.bsky.social

beercow.bsky.social @beercow.bsky.social · 07/11/2025

Weekly update. New features in OneDriveExplorer, Onedrive Evolution and schema updates. #DFIR malwaremaloney.blogspot.com/2025/11/oned...

malwaremaloney.blogspot.com

OneDrive updates

What's new in OneDriveExplorer OnedDriveExplorer v2025.11.07 now includes a dedicated parser for Microsoft.FilesOnDemand....

012

beercow.bsky.social @beercow.bsky.social · 16/10/2025

Adding a parser for Microsoft.FilesOnDemand.db to OneDriveExplorer. Yet another source to rebuild the user’s OnDrive. More to come. #DFIR

010

beercow.bsky.social @beercow.bsky.social · 16/10/2025

Did a little digging in Microsoft.FileUsageSync.db. Found some information to piece together OneDrive Quick Access. #DFIR malwaremaloney.blogspot.com/2025/10/oned...

malwaremaloney.blogspot.com

MALoney (It's in the name): OneDrive Quick Access

What is Quick access? Quick access makes it simple to find your frequently used storage locations, inclu...

001

beercow.bsky.social @beercow.bsky.social · 08/10/2025

Did a little digging in Microsoft.FileUsageSync.db. Found some information to piece together OneDrive Quick Access. #DFIR malwaremaloney.blogspot.com/2025/10/oned...

malwaremaloney.blogspot.com

MALoney (It's in the name): OneDrive Quick Access

What is Quick access? Quick access makes it simple to find your frequently used storage locations, inclu...

021

beercow.bsky.social @beercow.bsky.social · 23/09/2025

That time of year again when everybody starts abbreviating cybersecurity awareness month as CSAM. 21 pages deep of google searches for that term and not a single mention of cybersecurity awareness month. Go figure.

000

beercow.bsky.social @beercow.bsky.social · 22/08/2025

OneDrive Evolution has been updated to v25.162.0820.0001. That’s 692 versions OneDriveExplorer now handles. SafeDelete.db has been updated to schema v9. Enjoy! malwaremaloney.blogspot.com/p/onedrive-e... malwaremaloney.blogspot.com/p/safedelete...

malwaremaloney.blogspot.com

MALoney (It's in the name): OneDrive Evolution

Below is a collapsible indented tree depicting the contents of a OneDrive Profile. Each rectangle represents a file or directory and is lab...

000

beercow.bsky.social @beercow.bsky.social · 11/08/2025

Appears OneDrive snuck a new sync client in. Works with personal accounts at the moment. It’s WebView2. You can find data in the following locations: AppData\Local\Microsoft\OneDrive\OD4 AppData\Local\Microsoft\OneDrive\Logs\OD4 Where are my browser forensics experts at? #DFIR

001

beercow.bsky.social @beercow.bsky.social · 07/08/2025

Updated OneDrive Evolution. You can now compare two versions of OneDrive and see what has changed. #DFIR malwaremaloney.blogspot.com/p/onedrive-e...

000

beercow.bsky.social @beercow.bsky.social · 25/06/2025

Something you may not know. OneDriveExplorer also works for the OneDrive sync client for macOS. github.com/Beercow/OneD...

github.com

Release v2025.05.30 · Beercow/OneDriveExplorer · GitHub

Change Log Fixed ODL bug fix FileUsageSynce bug fix

021

beercow.bsky.social @beercow.bsky.social · 20/06/2025

Today we learned Fishrocket (the one with the doughnut) has cancer. It’s an aggressive form of mast cell tumors. Treatment usually involves removing them but there are too many. They prescribe prednisone because they itch. Has diabetes so can’t give him prednisone. Poor guy.

000

Reposted by @beercow.bsky.social

malmoeb.bsky.social @malmoeb.bsky.social · 19/06/2025

1/ I successfully tested a LSASS dumping technique on a Windows 10 lab machine, which we encountered on a recent Incident Response engagement (no EDR, default Defender installed). The "MiniDumpWriteDump" technique, as described here [1], was successful in writing the LSASS process to disk.

101

beercow.bsky.social @beercow.bsky.social · 18/06/2025

Another interesting forensic artifact in OneDrive. UXDatabase.db

000

beercow.bsky.social @beercow.bsky.social · 05/06/2025

New folder and databases in the OneDrive sync client. Not sure what feature they are tied to yet. More to come. #DFIR

010

beercow.bsky.social @beercow.bsky.social · 30/05/2025

Found a few bugs that would cause crashes in OneDriveExplorer around ODL and FileUsageSync. Update available. github.com/Beercow/OneD...

github.com

Release v2025.05.30 · Beercow/OneDriveExplorer · GitHub

Change Log Fixed ODL bug fix FileUsageSynce bug fix

000

beercow.bsky.social @beercow.bsky.social · 13/05/2025

Been a little while. Was busy adding support for Microsoft.FileUsageSync.db to OneDriveExplorer. Update brings in data on files shared via email, Teams, SharePoint and more. Thank you Heather Barnhart for the bug report on search function issues. #DFIR malwaremaloney.blogspot.com/2025/05/oned...

malwaremaloney.blogspot.com

MALoney (It's in the name): OneDriveExplorer now supports Microsoft.FileUsageSync.db

Recently, I have been focused on adding support for Microsoft.FileUsageSync.db. See my previous post on Microsoft.FileUsag...

000

beercow.bsky.social @beercow.bsky.social · 15/04/2025

Original post: infosec.exchange/@13reak/1143...

000

beercow.bsky.social @beercow.bsky.social · 11/03/2025

Hmmmm. What are we up to here? 🤔

000

beercow.bsky.social @beercow.bsky.social · 07/03/2025

Interesting thing with OneDrive Offline Mode for web. You can get the last two modification times of a file. Could come in handy. #DFIR

010

beercow.bsky.social @beercow.bsky.social · 19/02/2025

I just came across email information in one of the OneDrive databases. Sender, recipients, subject, mailbox, attachments, etc… Pretty much everything except the body. More to come. 🤔 #DFIR

031