Download History for a User

[Ephraim Mohan]

We are doing some forensics on a user account to view what files they may have downloaded in the past month. We can obtain this with Google Workspace's built in Investigation Tool, but there is no way to export that data from the tool. 

I've tried using this gam command, but it does not clearly state which files were downloaded or not. 

gam user <useremail> print driveactivity start 2024-04-01 end 2024-05-23 todrive

Thanks in advance for any advice/suggestions

[Maj Marshall Giguere]

Suggested reading: https://github.com/taers232c/GAMADV-XTD3/wiki/Reports#activity-reports

As an example get all the drive activity by some user:

> gam rediret csv ./userdriveactivity.csv report drive user some...@example.com previousmonths 1

This will give you all the drive activity for the user for the previous month.  The "name" column contains the type of activity.

--
You received this message because you are subscribed to the Google Groups "GAM for Google Workspace" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/c57e2e2f-0ba7-4666-aabb-bec8ffb33f58n%40googlegroups.com.

[Ross Scroggs]

See: https://github.com/taers232c/GAMADV-XTD3/wiki/Reports#activity-reports

gam report drive user <useremail> events download start -30d

Ross

----

Ross Scroggs

Ross.S...@gmail.com

[Ephraim Mohan]

Both solutions worked! 
Thanks very much most helpful.