Getting Started with Obliterator

Obliterator is a command line tool for targeted remediation of emails and cloud files from a set of target accounts. It is built for eDiscovery and digital forensics use cases where items have to be removed from custodians’ accounts under a court order, a settlement, a merger and acquisition, etc.

Workflow

1. Prepare an input CSV listing the items to remove. The input CSV is typically derived from the acquisition or review of the accounts. Note that the input CSV can contain multiple accounts for batch remediation.
2. Start a remediation by choosing the target provider, the desired authentication method and the input CSV.
3. If you are not supplying credentials via the input CSV or using centralized credentials such as domain-wide delegation or App-only Authentication, you will be asked to authenticate all target accounts before the batch remediation starts.
4. A summary of what will take place is shown for your confirmation.
5. Obliterator deletes the listed items while logging its actions and retrying items that failed for a transient reason.
6. Any remaining items can be retried at a later time by resuming the remediation project.

Tip

Forensic Email Collector acquisitions output Downloaded (Drive) Items Logs that are compatible for use in Obliterator as input CSVs.

Features

Supported Providers

Email

• Gmail / Google Workspace
• M365 and personal Microsoft accounts via Graph API
• On-premises Exchange and M365 via Exchange Web Services (EWS)
• IMAP servers, including Yahoo, AOL, and iCloud

Cloud Files

• Google Drive
• OneDrive (personal or business)
• SharePoint

Authentication

• Modern authentication for Google, Microsoft and major IMAP providers such as Yahoo and AOL
• Google domain-wide delegation through a Google service account to remediate multiple accounts in a Google Workspace tenant
• M365 App-only Authentication with a client secret or a certificate to remediate multiple accounts in an M365 tenant
• Basic authentication using a password or App Password, for IMAP and on-premises Exchange
• Exchange impersonation for on-premises Exchange
• Microsoft sovereign clouds: GCC High, DoD and China, in addition to the Azure commercial cloud (default)
• Per-account credentials can be supplied in the input CSV for remediations across multiple accounts

Forensic Logging and Hash Verification

• Hash verification (IMAP) Each message can optionally be compared with the hash calculated during its acquisition
• A detailed Remediation Log records actions taken
• Raw protocol logs for IMAP and EWS
• A Remaining Items Log lists every item not confirmed deleted and can be used as the input CSV of a subsequent remediation project
• A Soft Deleted Items Log lists items that were removed but are still recoverable (e.g., for providers that do not support permanent deletion)
• An Exception Log of encountered errors