Identifying OneDrive files that are not synced locally

[Jacques B]

OneDrive allows users to sync all files to their PC, or choose to free up space and only download a file if a user accesses it. Has anyone identified a criteria that you could filter on to identify OneDrive files where the filename is present on the computer, but is not stored on the computer?

I'm always looking at ways to automate tasks to help our investigators. I would like to be able to add a processing task at initial processing where I could flag files on the computer image that are not synced locally (thus, we only see the file name). This would allow an investigator to quickly filter on those files. If any bear names that might be relevant to their investigation, they can follow up with a request to get those files from IT (corporate environment).

I do know there is a great tool to process OneDrive artifacts (https://github.com/Beercow/OneDriveExplorer). I haven't tried it yet, but I've heard good things about it. If necessary, I can do some processing outside of Intella Connect with a tool such as this to identify the files not available locally and provide that to the investigator. But if it can be done within Intella Connect by looking for something in raw data or properties, that would be much more efficient.

Thanks,

Jacques