Collecting Evidence from Google Workspace

Let’s talk about something that often comes up during Google Workspace investigations: how do we actually collect logs and evidence properly?

If you’ve ever worked an incident involving Google Workspace, you already know that the platform gives you a lot of data—but not all of it is equally easy to collect or analyze. Broadly speaking, there are two main ways to collect evidence from Google Workspace:

1. Using the Workspace Admin interface (UI)

2. Using the Workspace Admin SDK / APIs

On paper, both give you access to similar information. In reality, they behave quite differently—and those differences really matter during forensic analysis

Let’s break this down in a simple, practical way.

-------------------------------------------------------------------------------------------------------------

Option 1: Using the Google Workspace Admin Interface

The Admin interface is usually where everyone starts—and honestly, it’s not a bad place to begin.

It gives you a visual and human-friendly way to explore logs. You can click through different sections, filter events, and clearly see what’s going on. '

This is especially useful when:

• You’re doing a quick triage

• You need to show evidence to a manager, legal team, or client

• You want to visually confirm suspicious activity

The downside?

All the useful data is scattered across different screens.

If you want to investigate a full Workspace compromise, you’ll likely need to:

• Jump between Drive logs

• Check login and authentication activity

• Review OAuth and third‑party app access

• Inspect Admin console changes

Each of these lives in a different place. That means a lot of clicking, filtering, exporting, and repeating the process again and again. It works—but it’s slow.

Export limitations

There are a few important limitations to keep in mind:

• You can only export 10,000 or 100,000 events per log type.

• If you exceed that limit, you must split your search into smaller time ranges

• Logs are exported only as Google Sheets (GSheet) from the UI

You can later convert those sheets into CSV, but it’s an extra step—and not ideal if you’re planning to ingest logs into a SIEM or timeline tool.

Name the tool for working with those CSV exports

If you go the UI/GSheet route, don't just open these in Excel — there's a purpose-built free tool for this:

Eric Zimmerman's Timeline Explorer.

It imports the CSV export directly and lets you search and filter it far faster than Excel ever will. One thing worth checking every time you use it: look at the highest row number Timeline Explorer shows you. If it lands right at 10,000 or 100,000, that's not a coincidence — you've hit the UI export cap, and there's more data you haven't seen yet. Split your time range and pull the rest.

---

Option 2: Collecting Logs via the Workspace Admin SDK (API)

Now this is where things get really interesting for forensic work.

The Workspace Admin SDK allows you to collect logs programmatically using API calls. Once set up, this becomes the fastest and most consistent way to gather evidence.

Yes, the initial setup takes some effort—you’ll need:

• A Service Account

• The right Workspace permissions

• Some basic scripting knowledge

But once that’s done, everything becomes repeatable and scalable.

Types of reports you can collect

Using the API, you can pull two main types of reports:

1. Activity Reports

These tell you what actually happened across Workspace services, including:

• Google Drive activity

• Authentication and login events

• OAuth and third‑party application access

• Admin console changes

These are gold during investigations because they help you track changes, abuse, and attacker actions.

2. Usage Reports

These focus more on how user accounts are being used over time. They’re great for spotting anomalies or misuse patterns.

Why investigators prefer API logs

There are several big advantages here:

• No event limits like the UI exports

• Logs are returned in JSON format, which is perfect for:

  • SIEM ingestion

  • Timeline creation

  • Custom parsing and analysis

• All timestamps are in UTC, which avoids time zone confusion

• Collection can be fully scripted, ensuring consistency every time

In short: if you’re doing a serious investigation, the API approach is hard to beat.

-------------------------------------------------------------------------------------------------------------

Option 3: Sending Google Workspace Logs to Google Cloud Logging

There’s a third option that often gets overlooked—but it’s extremely powerful.

Google Workspace can send certain logs directly to Google Cloud Logging. This allows you to:

• Retain logs for a much longer period

• Query them using Cloud Log Explorer

• Correlate Workspace logs with other Google Cloud activity

You Must enabled the sharing which is disabeld by default

The catch

Not all Workspace logs are sent to Google Cloud.

Only five log types are forwarded—and while these are some of the most valuable ones for investigations, they don’t always tell the full story.

Name the five log types that actually get forwarded

Specifically, these five:

Admin Activities, Enterprise Groups, Login Audit, OAuth Token, and SAML. These map to four service names you'll actually query in Cloud Logging (admin.googleapis.com, cloudidentity.googleapis.com, login.googleapis.com, oauth2.googleapis.com) — which lines up with the query further down this article.

Knowing the five by name up front makes it obvious at a glance whether the data you need is even in scope for this method, instead of finding out the hard way mid-investigation.

For example:

• Email transit and email access logs are not included

• You cannot customize which logs are sent

• Google decides what gets forwarded—you only choose whether forwarding is enabled or not

So while this method is fantastic for long‑term visibility, it should be seen as a complement, not a replacement, for API‑based collection.

-------------------------------------------------------------------------------------------------------------

Permissions: A Common Roadblock

If you try to search Workspace logs in Google Cloud and run into permission errors—don’t panic.

This usually means your account doesn’t have enough rights to query logs.

https://docs.cloud.google.com/logging/docs/access-control

The fix is simple:

• Go to IAM & Admin in Google Cloud

• Grant the appropriate role (typically Logging Admin or equivalent)

  

Once that’s done, Log Explorer will start behaving as expected.

Log Explorer Example

Querying Workspace Logs in Google Cloud

When Workspace logs arrive in Google Cloud, they are spread across a few service names. To search them together, you can use a query like this in Log Explorer:

protoPayload.serviceName = (
  "admin.googleapis.com" OR
  "cloudidentity.googleapis.com" OR
  "login.googleapis.com" OR
  "oauth2.googleapis.com"
)

Example:

protoPayload.serviceName = (
  "login.googleapis.com" 
)

One important thing to remember: you need to be viewing logs at the root organization level in Google Cloud.

-------------------------------------------------------------------------------------------------------------

Final Thoughts

If we simplify everything:

• Admin UI → great for quick checks and visual walkthroughs

• Admin SDK / API → best for fast, consistent, forensic‑grade evidence collection

• Google Cloud Logging → excellent for long‑term retention and centralized querying

In real investigations, the strongest approach is usually a combination of all three.

------------------------------------------Dean-------------------------------------------------------------