Investigating Data Exposure in Google Drive

If you’ve worked in Google Workspace long enough, you already know this truth:

Google Drive is where data leaks love to happen.

Not always malicious. Sometimes it’s just:

• “Oops, shared it publicly”

• “Oops, shared it with the wrong domain”

• “Oops, didn’t realize Anyone with the link means literally anyone”

So when data exposure happens, we usually care about two questions:

1. What happened to the file?

2. Can we still access or recover it?

That’s where Google Drive investigation tools come in.

-------------------------------------------------------------------------------------------------------------

Tool 1: Google Drive Log Events (Your Timeline, Not Your Files)

Think of the Drive Log Events as your CCTV footage, not the evidence locker.

What it’s good at:

• Showing who did what

• Showing when it happened

• Showing permission changes

• Near real-time visibility (usually within minutes)

What it’s not good at:

• Accessing files

• Showing file contents

• Tracking anonymous viewers or downloads

Key Things to Know About Drive Log Events

Let’s break this down simply:

• Keeps 6 months of history

• Logs actions like:

  • File creation

  • Sharing changes

  • Permission updates

  • Deletions

• Does NOT give you the file itself

• CSV export is limited to 100,000 rows

• Unauthenticated access is only logged for editing

  • Viewing or downloading by anonymous users? ❌ Not logged

So if a file was publicly shared and downloaded 1,000 times anonymously — the audit log will not tell you that.

Painful, but important to know upfront.

Where Are Drive Log events Now?

Earlier, Drive log events lived in their own section. That changed.

Today, Drive Log Events live inside  in the Google Admin Console.

Inside Investigator, you can:

• Filter events

• Use AND / OR logic

• Group by fields (user, document, event type)

• Search using partial matches

One warning though ⚠️Even though logs are generated quickly, some events can lag up to 12 hours before showing up.

------------------------------------------------------------------------------------------------------------

Tool 2: Google Vault (This Is Where the Files Live)

If Audit Logs are the timeline, Vault is the evidence room.

Vault is what you use when:

• You actually need the document

• A file was deleted

• A user “accidentally” removed something important

But Vault comes with conditions.

What Vault Can Do

• Access files in user Drives

• Access deleted files

• Apply holds

• Enforce retention rules

What Vault Cannot Do

• Give you an audit trail

• Tell you who did what and when

It’s access, not visibility.

Deletion Timelines (This Matters a LOT)

Here’s the reality of deleted files:

• When a user deletes a file → it goes to Trash

• Trash keeps files for 30 days

• Once removed from Trash:

  • Admins have 25 more days to recover (without Vault)

  • ·With Vault, that window extends to 25–40 days total from the original deletion date — the extra 15 days depends on when Google actually purges the file from its own storage

• Custom retention rules or holds = files stay longer

If Vault is enabled, you can often recover files without restoring the user account.

------------------------------------------------------------------------------------------------------------

Alternate File Recovery Scenarios (The “Oh No” Cases)

Case 1: Active User Deleted Files

• Trash keeps files for 30 days

• After Trash deletion:

  • Admins have 25 days to restore

• Restore options:

  • Original location

  • Shared Drive

No Vault license? After 25 days — game over.

Case 2: Deleted User Account

This one catches teams off guard.

• Deleted user accounts can be restored for 20 days

• Files can only be recovered if:

  • The user account is restored first

  • Or Vault is used

• Ownership transfer is another option:

  • Files move to another user’s Drive

Again — Vault makes life easier here.

------------------------------------------------------------------------------------------------------------

Exporting Drive Logs

Once you've found the events that matter, you don't want to sit there scrolling — you want them out of the console and into something you can search, filter, or hand off.

Where to export:

•  From the Investigation Tool (Admin Console → Security → Investigation Tool), run your filtered search, then use Export → CSV.

• Vault has its own export flow (Vault → Search → Export), if you're pulling files or metadata for a hold rather than just the audit trail.

What you get:

• A CSV of the events matching your filters — actor, timestamp, IP, document ID, visibility change, and the other fields covered above.

• Capped at 100,000 rows per export. If you're hunting something broad (a domain-wide sharing change, for example), narrow the filter first or you'll quietly lose rows past the ceiling.

One more thing to know:

• Exports don't include file contents — same limitation as the log events themselves. You're exporting the trail, not the evidence.

• Large exports can take a few minutes to generate; Google emails you a download link rather than streaming it back instantly.

Clunky, but it's the difference between "I remember seeing something" and having a file you can actually attach to a ticket.

Once you've got that CSV, don't just open it in Excel and start scrolling.

Eric Zimmerman's Timeline Explorer handles this kind of exported log data far better — filter, sort, and pivot without losing your place, and you're not fighting Excel's row limits or crash-on-large-file quirks. Especially useful if you're keeping the analysis off the (possibly compromised) Workspace tenant entirely.

------------------------------------------------------------------------------------------------------------

Important Fields You’ll Actually Use During an Investigation

Let’s translate the useful ones into investigator language:

Document ID

This is gold.

• Unique across all Google Workspace tenants

• Same ID you see in the document URL

• Perfect for matching phishing URLs to actual Drive files

Owner vs Actor

• Owner: Who owns the file

• Actor (User field): Who performed the action

These are often not the same person.

Visibility & Prior Visibility

This tells the real story.

• Prior Visibility → what access looked like before

• Visibility → what access looks like now

This is how you catch:

• Private → Public changes

• Internal → External sharing

• Domain-wide exposure

IP Address

Extremely useful for:

• Geo anomalies

• Impossible travel

• Correlation with other Workspace logs

One more field worth knowing:

### Billable

·         Shows whether the document counts toward the user's storage quota

·         Only actually populated on the Essentials edition

Small field, easy to skip — but if you're chasing a storage-quota mystery on an Essentials tenant, this is the column that explains it.

------------------------------------------------------------------------------------------------------------

Final Thoughts (The Big Picture)

• Drive log events — who did what, and when

• Vault — the actual file, if you need to see or recover it

• Visibility & Prior Visibility — how exposure changed, and when it changed

• An export — so the timeline survives the investigation, not just your memory of it

No single tool gives you the full picture. Put them together, and you've got one.

---------------------------------------------Dean-----------------------------------------------------------