OneDrive SafeDelete.db

Monitor the presence and contents of the OneDrive SafeDelete.db file to identify subject-driven deletion of local files synced via OneDrive cloud storage. This SQLite database is located at: C:\Users\<username>\AppData\Local\Microsoft\OneDrive\settings\Personal\SafeDelete.db
 

The file contains a table named items_sent_to_recycle_bin, with the following notable records:

• itemName: The name and extension of each deleted file.
• notificationTime: The epoch timestamp when the file was sent to the Recycle Bin.

KAPE has a default Target module to acquire the parent directory of this database called “OneDrive_Metadata”. Use forensic tools or software such as DB Browser (SQLite) to view or extract entries from the items_sent_to_recycle_bin table.

This database persists across standard user deletion workflows and may retain entries long after file removal, offering high-value retrospective insight into deletion behaviors. itemName could help guide forensic carving of deleted files from disk images or shadow copies, even if the Recycle Bin has been emptied.