Everything we collect

Find details below on what evidence and metadata we have available from each platform

Not all properties are available on all files every time. Get in touch if you think there is an issue

Google Drive

Core file metadata:

  • File ID (Google's unique identifier)

  • File name

  • MIME type (the actual file format)

  • File size in bytes

  • MD5 checksum (Google's own hash of the file)

Timestamps:

  • Created time

  • Modified time

  • Viewed by me time (last time the account owner opened it)

  • Shared with me time (if applicable)

Ownership and permissions:

  • Owner email and name

  • Whether the file is shared

  • Sharing permissions and who has access

  • Whether it's in a shared drive

Structure and context:

  • Parent folder IDs (we reconstruct the full folder path)

  • Full folder hierarchy/path

  • Whether it's in the trash

  • Whether it's starred

For Google Workspace files (Docs, Sheets, Slides), we export them to standard formats (DOCX, XLSX, PPTX) since they don't exist as downloadable files natively—they're database records. We document this conversion in the chain of custody.

Microsoft OneDrive

Core file metadata:

  • Item ID (Microsoft's unique identifier)

  • File name

  • MIME type

  • File size in bytes

  • CRC32 hash (Microsoft's checksum)

  • SHA1 hash (if available)

  • SHA256 hash (if available)

Timestamps:

  • Created datetime

  • Last modified datetime

  • Last accessed datetime (if available)

Ownership and context:

  • Created by (user display name and email)

  • Last modified by (user display name and email)

  • Drive ID (which OneDrive the file belongs to)

  • Site ID (for SharePoint-backed locations)

Structure and context:

  • Parent folder IDs (we reconstruct the full folder path)

  • Full folder hierarchy/path

  • Whether it's in the trash

  • Whether it's starred