# dtFabric format specification.
---
name: onedrive
type: format
description: OneDrive log
urls: ["https://forensics.wiki/microsoft_onedrive/"]
---
name: uint8
type: integer
attributes:
  format: unsigned
  size: 1
  units: bytes
---
name: uint16
type: integer
attributes:
  format: unsigned
  size: 2
  units: bytes
---
name: uint32
type: integer
attributes:
  format: unsigned
  size: 4
  units: bytes
---
name: uint64
type: integer
attributes:
  format: unsigned
  size: 8
  units: bytes
---
name: pascal_string
type: structure
attributes:
  byte_order: little-endian
members:
- name: size
  data_type: uint32
- name: value
  type: string
  encoding: ascii
  element_data_type: uint8
  number_of_elements: pascal_string.size
---
name: onedrivelog_file_header
type: structure
attributes:
  byte_order: little-endian
members:
- name: signature
  type: stream
  element_data_type: uint8
  elements_data_size: 8
  value: "EBFGONED"
- name: version
  data_type: uint32
- name: unknown2
  data_type: uint32
- name: unknown3
  data_type: uint64
- name: unknown4
  data_type: uint32
- name: one_drive_version
  type: stream
  element_data_type: uint8
  elements_data_size: 40
- name: reserved
  type: stream
  element_data_type: uint8
  elements_data_size: 64
---
name: odl_data_block_header
type: structure
attributes:
  byte_order: little-endian
members:
- name: signature
  data_type: uint64
  value: 0xffeeddcc
- name: timestamp
  data_type: uint64
- name: unknown1
  data_type: uint32
- name: unknown2
  data_type: uint32
- name: unknown3_guid
  type: stream
  element_data_type: uint8
  elements_data_size: 16
- name: unknown4
  data_type: uint32
- name: unknown5
  data_type: uint32
- name: data_size
  data_type: uint32
- name: unknown6
  data_type: uint32
---
name: odl_data_block
type: structure
attributes:
  byte_order: little-endian
members:
- name: code_filename_size
  data_type: uint32
- name: code_filename
  type: stream
  element_data_type: uint8
  number_of_elements: odl_data_block.code_filename_size
- name: unknown
  data_type: uint32
- name: code_function_name_size
  data_type: uint32
- name: code_function_name
  type: stream
  element_data_type: uint8
  number_of_elements: odl_data_block.code_function_name_size
