Examples

This page contains detailed usage examples that include sample input CSVs, command line arguments, and what to expect once the remediation is running.

Before You Start

• Secrets are not supplied as command line arguments. A client secret, password or certificate password that is omitted is asked for before remediation starts. So, the secrets do not end up in your shell history. The examples rely on this throughout.
• The commands are written for PowerShell, and are run from the folder that contains Obliterator.exe. A line ending in a backtick (`) continues on the next line. When using Command Prompt, replace each backtick with ^.
• Relative paths are resolved against the current folder. So, a log directory such as logs\twin-pines is created beside Obliterator.exe, not beside the project.
• Each example stops at a summary and asks before the first deletion. Add --yes only for unattended, scripted remediation.

Yahoo Mail with Modern Authentication

Two Yahoo mailboxes accessed over IMAP using modern authentication (OAuth).

What You Need

• An app registered in the Yahoo developer portal with read/write access to Mail. Its client ID goes on the command line, and its client secret is prompted for.
• Credentials for the target Yahoo accounts. Since the remediation is using modern authentication, an App Password is not needed.

Input CSV (fluxcap.csv)

IMAP uses the folder name to address a message. Therefore, each CSV line must contain folder information.

ServiceId,Folder,TargetEmail
CRDYQIAAE9h,Inbox,[email protected]
DhbJ2MAAD0r,Sent,[email protected]
BXPuqYAAQG0,Archive,[email protected]
CRDYQIAAQ67,Inbox,[email protected]
DlGwukAARu1,Inbox,[email protected]

Command

.\Obliterator.exe start -p outatime.obproj `
  --provider Imap --auth-mode Interactive --imap-oauth-provider yahoo `
  --client-id <client-id> -i fluxcap.csv

Workflow

1. Obliterator asks for the client secret.
2. For each account in turn, it opens Yahoo’s consent page in the browser. Yahoo shows an authorization code on its own page, and you type it in when Obliterator asks.
3. After both accounts are authenticated, the summary is shown and your confirmation is required to start remediation.

The server, export.imap.mail.yahoo.com, comes from the preset, so --imap-host is not needed.

Caution

When performing modern authentication, Yahoo’s token carries no identity, so Obliterator cannot check that the account that authenticated is the one listed on the input CSV. This is indicated in the Remediation Log.

Microsoft Personal Account with Modern Authentication

An Outlook.com mailbox, remediated through Microsoft Graph. The same applies to Hotmail, Live and MSN, and to a personal Microsoft account on any other domain.

What You Need

• An Azure app registration whose Supported account types is Any Entra ID Tenant + Personal Microsoft accounts. Organizational-only registrations refuse a personal account at the sign-in page.
• A Mobile and desktop applications redirect URI of http://localhost, and the delegated Mail.ReadWrite permission (IMAP.AccessAsUser.All when using IMAP). See App Registration.
• Credentials to the target mailbox.

A personal account remediation via Graph API requires no tenant ID or client secret.

Input CSV (daisy.csv)

ServiceId,TargetEmail
AQMkADAwATM0MDAAMi1kNjk4LTgwNzgtAAAD7xOB9gAAAA==,[email protected]
AQMkADAwATM0MDAAMi1kNjk4LTgwNzgtAAAD7xOB9gAAAQ==,[email protected]
AQMkADAwATM0MDAAMi1kNjk4LTgwNzgtAAAD7xOB9gAAAg==,[email protected]

Command

Microsoft Graph

.\Obliterator.exe start -p discovery.obproj `
  --provider GraphMail --auth-mode Interactive --client-id <client-id> `
  -i daisy.csv

IMAP

The same mailbox over IMAP, for a CSV taken from an IMAP acquisition. Every row then needs a Folder, and the server comes from the mspersonal preset.

.\Obliterator.exe start -p discovery.obproj `
  --provider Imap --auth-mode Interactive --imap-oauth-provider mspersonal `
  --client-id <client-id> -i daisy.csv

Workflow

The browser opens Microsoft’s sign-in page with the custodian’s email address prepopulated. Obliterator checks the authenticated identity and refuses remediation if it does not match the TargetEmail.

Personal OneDrive

A personal account’s OneDrive has no permanent delete feature. A --provider OneDrive remediation of a personal Microsoft account is refused unless it is started with --allow-soft-delete. In that scenario, deleted items go to the OneDrive Recycle Bin, removed but still recoverable.

M365 Mail with App-only Authentication

Three mailboxes in an M365 tenant, remediated using App-only Authentication. This is a common choice for enterprise remediation scenarios where multiple custodians are targeted.

What You Need

• An Azure app registration in the custodians’ tenant with the application permission Mail.ReadWrite, granted admin consent.
• A client secret or a certificate for that registration.
• The tenant ID.

See App Registration.

Input CSV (crew-expendable.csv)

With App-only Authentication, TargetEmail can be any email address of the mailbox.

ServiceId,TargetEmail
AAMkADk3ZTQ1NjE4LTc3YjMtNDI2Mi05MzdlAAA=,[email protected]
AAMkADk3ZTQ1NjE4LTc3YjMtNDI2Mi05MzdlAAE=,[email protected]
AAMkADk3ZTQ1NjE4LTc3YjMtNDI2Mi05MzdlAAI=,[email protected]
AAMkADk3ZTQ1NjE4LTc3YjMtNDI2Mi05MzdlAAM=,[email protected]

Command

Client secret

The client secret is prompted for.

.\Obliterator.exe start -p order-937.obproj `
  --provider GraphMail --auth-mode AppOnlySecret --client-id <client-id> `
  --tenant-id <tenant-id> -i crew-expendable.csv

Certificate

The certificate’s password is prompted for. The PFX certificate is stored in the remediation project.

.\Obliterator.exe start -p order-937.obproj `
  --provider GraphMail --auth-mode AppOnlyCertificate --client-id <client-id> `
  --tenant-id <tenant-id> --pfx-path mu-th-ur.pfx `
  -i crew-expendable.csv

GCC High

The same remediation in a sovereign cloud. --tenant-id is required.

.\Obliterator.exe start -p order-937.obproj `
  --provider GraphMail --auth-mode AppOnlySecret --cloud GccHigh `
  --client-id <client-id> --tenant-id <tenant-id> `
  -i crew-expendable.csv

Workflow

Since App-only Authentication uses the same set of credentials for multiple mailboxes, identity check does not apply.

Google Workspace with Domain-Wide Delegation

Multiple accounts in a Google Workspace tenant remediated using domain-wide delegation of authority. As with M365 App-only Authentication, one set of credentials accesses all target accounts.

What You Need

• A Google service account with a JSON key, in a Google Cloud project with the Gmail API enabled.
• Domain-wide delegation granted to that service account in the Google Admin console, under Security > Access and data control > API controls > Domain-wide delegation. Add its client ID with the scope https://mail.google.com/ (enable Drive API and add the https://www.googleapis.com/auth/drive scope if targeting Google Drive files).

See App Registration.

Input CSV (swingline.csv)

ServiceId,TargetEmail
18c3f1a2b4d5e6f7,[email protected]
18c3f1a2b4d5e6f8,[email protected]
18c3f1a2b4d5e6f9,[email protected]
18c3f1a2b4d5e6fa,[email protected]
18c3f1a2b4d5e6fb,[email protected]

Command

Gmail

.\Obliterator.exe start -p cover-sheets.obproj --provider Gmail --auth-mode Dwd `
  --dwd-json initech-dwd.json -i swingline.csv

Gmail (Bulk Mode)

For a large remediation, Bulk deletes up to 1,000 messages per request. Gmail reports nothing per message for a bulk request, so every deletion is verified afterwards.

.\Obliterator.exe start -p cover-sheets.obproj --provider Gmail --auth-mode Dwd `
  --dwd-json initech-dwd.json --deletion-mode Bulk `
  -i swingline.csv

Google Drive

The same Google service account can remediate Drive files. Enable the Drive API, add https://www.googleapis.com/auth/drive to the delegation, and use a CSV of Drive file IDs.

.\Obliterator.exe start -p cover-sheets-drive.obproj `
  --provider GoogleDrive --auth-mode Dwd --dwd-json initech-dwd.json `
  -i swingline-files.csv

Workflow

The JSON key is stored in the remediation project.

Google Drive with Modern Authentication

Files in two custodians’ Google Drives, remediated by authenticating interactively for each account. This can be a viable option when the target accounts are personal Google accounts or when a Google Workspace administrator does not allow the use of domain-wide delegation of authority.

What You Need

• A Google Cloud OAuth client of type Desktop app, in a project with the Google Drive API enabled and the consent screen in Testing. Its client ID is supplied as a command line argument and its client secret is prompted for. See App Registration.
• Credentials for the target accounts.

Tip

While the Google Cloud project’s OAuth consent screen is in Testing, only the test users it lists can grant consent. Add each custodian’s account as a test user before the remediation starts.

Input CSV (chamber19.csv)

ServiceId,TargetEmail
1kR7vQm2XbT9pLw4ZcN8yHd3JfG6sAe0U,[email protected]
1Qw8eRt5yUi2oPa7sDf4gHj9kLz3xCv6B,[email protected]
1Mn5bVc8xZa2sDq7wEr4tYu9iOp3lKj6H,[email protected]

Command

.\Obliterator.exe start -p black-forest.obproj `
  --provider GoogleDrive --auth-mode Interactive --client-id <client-id> `
  -i chamber19.csv

Workflow

1. Obliterator asks for the client secret.
2. For each account, the browser opens Google’s consent page for that target address for authentication.
3. Obliterator confirms with Google Drive that the account that authenticated is the one the CSV names, and skips an account that does not match.
4. The summary is shown and you confirm the permanent deletion.

Files are deleted permanently, bypassing Drive’s trash.

More Examples

IMAP with hash verification

Basic authentication against an IMAP server, with every message’s SHA-256 hash compared with the one recorded during acquisition before the message is deleted. A message that does not match is left in place. Each account’s password is prompted for unless it is supplied by the input CSV’s Password column.

bypass.csv:

ServiceId,Folder,Mime Hash [SHA256],TargetEmail
CRDYQIAAE9h,INBOX,92D7B8C6689FC32DE6DF7869BCC246CFABF5C8331346B97BCFA61EB43A80EE68,[email protected]
DhbJ2MAAD0r,INBOX/Bypass,5F31E15920D4B59BF8F4B54DE8BD8EAA713E0721A9E684E693A9D99B64736948,[email protected]

.\Obliterator.exe start -p mostly-harmless.obproj --provider Imap --auth-mode Basic `
  --imap-host imap.megadodo.example --verify-hashes `
  -i bypass.csv

On-premises Exchange

One service account acting on every mailbox through Exchange impersonation. The service account’s password is prompted for.

.\Obliterator.exe start -p august-29.obproj `
  --provider Ews --auth-mode Basic --ews-url https://mail.cyberdyne.example `
  --use-impersonation --username svc-mdyson `
  -i model-101.csv

SharePoint

Files in SharePoint document libraries remediated with App-only Authentication and a certificate. The registration needs the application permission Sites.ReadWrite.All, granted admin consent. Each row names its document library with a DriveId, which is the most efficient way to address a file. A row can name a Site instead, and Obliterator then searches the site’s libraries (see Input CSV).

ServiceId,TargetEmail,DriveId
01HMIZEHGI2VLPBGGYYL6YOK6XCD7YPFXQ,[email protected],b!Tq3v9Wm2kQpL0yZ4aRj8dHc1uF6N
01LSSV4VPA5JK2DOCMITH4ZCKHOCEFMWEE,[email protected],b!Tq3v9Wm2kQpL0yZ4aRj8dHc1uF6N

.\Obliterator.exe start -p tannhauser.obproj `
  --provider SharePoint --auth-mode AppOnlyCertificate --client-id <client-id> `
  --tenant-id <tenant-id> --pfx-path voight.pfx `
  -i offworld.csv

Resume

Pick up where a remediation left off (e.g., after it was stopped with S S ). --retry-permanent-errors also attempts the items recorded as permanent errors once more. Remaining settings are populated from the existing remediation project settings.

.\Obliterator.exe resume -p outatime.obproj --retry-permanent-errors

Unattended

A scripted remediation with no one at the keyboard. --yes skips the confirmation, so only authentication modes that need no browser sign-in and no prompt are suitable, and the Windows user running it must already have accepted the EULA interactively. The exit code tells a script whether items remain (1), the remediation was refused (2), or it failed (70).

.\Obliterator.exe start -p cover-sheets.obproj --provider Gmail --auth-mode Dwd `
  --dwd-json initech-dwd.json `
  -i swingline.csv --yes