DriveFSCacheCorrelator
1.0.1
Correlates Google Drive for desktop content_cache IDs to original file metadata by manually parsing the SQLite DB and WAL.
Installation Options
Owners
Package Details
Author(s)
- Nebian
Tags
forensics dfir sqlite google-drive powershell drivefs-cache
Functions
Show-Usage Write-VerticalResults Read-At Get-Slice ConvertTo-ByteArray Read-BEUInt16 Read-BEUInt32 Read-LEUInt32 Read-WalChecksumUInt32 Add-UInt32Wrap Update-WalChecksum Initialize-WalOverlay Read-SignedBE Read-Varint Get-Page Get-TableLeafCellPayload ConvertFrom-SqliteRecord Get-SqliteSchemaRows Get-TablePageHeaderOffset Get-TableLeafCells ConvertTo-ProtobufVarint Get-ContentEntryPrefix Test-ByteArrayStartsWith Resolve-TableRoots Get-ItemPropertiesMatches Get-ItemsByStableId
Dependencies
This script has no dependencies.
FileList
- DriveFSCacheCorrelator.nuspec
- DriveFSCacheCorrelator.ps1
Version History
| Version | Downloads | Last updated |
|---|---|---|
| 1.0.1 (current version) | 7 | 4/21/2026 |
| 1.0.0 | 4 | 4/21/2026 |