support for parsing OneDrive Log files .odl

[jtmoon79]

Summary

According to Reading OneDrive Logs from forensic blog

Due to the popularity of OneDrive, it has become an important source of evidence in forensics.

support for .odl files

.odl files can be found on Windows 11 at ${env:APPDATA}\Local\Microsoft\OneDrive\logs\Common}

This is a proprietary format with magic string EBFGONED as the first 8 bytes.

The file format is a header Odl_header followed by fixed-size structures Data_block and Data. ^archive

Project ydkhatri/OneDrive^archive has Python code for viewing .odl files.