Google Workspace DFIR Tool

Configuring the API

Note This requires an admin account for the Google Workspace organization.

Log in to https://console.developers.google.com/cloud-resource-manager and log in with admin credentials.
Create a new project
Go to https://console.developers.google.com/apis/dashboard and ensure the created project is selected at the top left.
Select Credentials on the left and choose OAuth Client ID.
Choose Web application for the application type
Download the JSON credentials file (rename if desired, to something such as credentials.json).
Put the file in the path you designated in the config.json file

The config.json file allows you to define the file path where credential and MaxMind DB files are located
The Geolite2-City.mmdb file can be downloaded from the MaxMind website.

python3 google_dfir.py -o <output file>

Note: The output option should should provide the full path and file name (XLSX). Ex. /User/bob/results.xlsx