Input CSV

The input CSV is the list of items a remediation targets, and is typically built from the Service IDs recorded when the account was acquired or reviewed.

You can pass the input CSV to the start command with the --input (or -i) switch.

File Format

• A header row is required. Columns are found by their header, so their order does not matter.
• Headers are matched in a case insensitive manner, and several spellings are accepted for most columns (see Columns).
• Only the columns you need have to be present. A column that a provider does not use can be left out. Columns Obliterator does not recognize are ignored. So, an export from another tool such as FEC can often be used as is, without worrying about removing the unnecessary columns.
• UTF-8 encoded, with or without a byte order mark. A value containing a comma or a double quote has to be enclosed in double quotes, as many tools do when handling CSVs.

Columns

Column	Accepted headers	Contents
ServiceId	ServiceId, Service ID	The provider’s identifier for the item. See Service IDs.
TargetEmail	TargetEmail, Target Email, TargetAccount	The account the item belongs to. See Target Accounts.
Folder	Folder	(IMAP only) The mailbox folder holding the message, e.g., INBOX or Archive/2023.
Mime Hash	Mime Hash [SHA256], Mime Hash [SHA1], Mime Hash [MD5], Mime Hash [SHA512], Mime Hash, MimeHash, Hash	(IMAP only) The hash of the raw MIME message, used with --verify-hashes.
DriveId	DriveId, Drive ID	(OneDrive and SharePoint only) The Drive where the item is located.
Site	Site	(SharePoint only) The site URL, for items without a DriveId.
Username	Username, Account Username	(Basic authentication only) The account’s username.
Password	Password, Account Password, App Password, AppPassword	(Basic authentication only) The account’s password or App Password.

Required Columns by Provider

Provider	ServiceId	TargetEmail	Folder	Mime Hash	DriveId	Site	Username, Password
Gmail	Required	Required
GoogleDrive	Required	Required
GraphMail	Required	Required
OneDrive	Required	Required			Optional
SharePoint	Required	Required			Either DriveId or Site	Either DriveId or Site
Ews	Required	Required					Optional with Basic
Imap	Required	Required	Required	Required with --verify-hashes			Optional with Basic

A blank cell in the table means the provider does not use that column. A DriveId value for a provider other than OneDrive or SharePoint is refused, and Username and Password values are ignored with a warning outside of basic authentication.

Service IDs

ServiceId is the identifier the provider uses to address each item.

Provider	What Service ID Contains	Example
Gmail	The Gmail API message ID	278dcb960d99b98c
GoogleDrive	The Google Drive file ID	1MnpbPsGs2c84oMXCsI1T-lSNjDQlKQYj
GraphMail	The Microsoft Graph message ID	AAMkAKzh0NpQ-sVOTLxT...
Ews	The EWS item ID	AAMkAHawKzwPTuMOAPwB...
OneDrive, SharePoint	The Microsoft Graph Drive item ID	016ZGWK5ATH6TMNW7JAQT4KHWQFFAMRBH3
Imap	The composite unique ID, which combines the message’s UID with its folder’s UIDVALIDITY	CRDYQIAAE9h

Note

An IMAP Service ID addresses an item within a specific mail folder. This is why Folder is required for IMAP.

Target Accounts

TargetEmail indicates the account to which each item belongs, and it is always required.

Which address of an M365 account the provider accepts depends on how you authenticate:

Remediation	TargetEmail must be
Any interactive Microsoft sign-in	The account’s sign-in address (its UPN), which can differ from its email address
GraphMail, App-only Authentication	Any email address of the mailbox
Ews, App-only Authentication	The mailbox’s primary email address
OneDrive, App-only Authentication	The sign-in address (UPN), for an item without a DriveId

For OneDrive and SharePoint, TargetEmail is the email address of a custodian whose credentials can access the target item.

Provider Notes

IMAP

• Folder is used exactly as given. It is not normalized, so Inbox and INBOX are different folders to Obliterator.
• Gmail over IMAP requires every copy of an item to be listed. Every Gmail message is visible in [Gmail]/All Mail as well as in INBOX and each of its labels’ folders, and it is only deleted once it is expunged from all of them. List the Folder and ServiceId of every copy, as a full Gmail IMAP acquisition (e.g., FEC acquisition) records them. TIP We generally recommend Gmail API over IMAP for Gmail remediation.

Hash Verification

With --verify-hashes, each message is downloaded and compared with the hash in the CSV before it is deleted.

• Every row must have a hash. A CSV with a blank hash is refused.
• The hash algorithm is chosen by --verification-hash-type, not by the header. The bracketed header is only a label.

OneDrive and SharePoint

• DriveId addresses an item exactly. An item ID is unique only within its Drive, so a DriveId is the most precise way to identify a file. It can name any Drive the credential can access, e.g., another user’s OneDrive shared with the custodian, or a SharePoint document library.
• Without a DriveId, OneDrive uses the custodian’s own OneDrive, and SharePoint searches the document libraries of the row’s Site.
• Prefer DriveId for SharePoint. Searching a site’s libraries is computationally expensive. Where a row has both, the DriveId is used.
• Rows with and without a DriveId can be mixed in one CSV.

Per-account Credentials

For basic authentication (IMAP, and on-premises EWS without --use-impersonation), each account can carry its own login in the Username and Password columns.

• Username is optional. It defaults to the TargetEmail. Supply it only when the username differs, e.g., EXAMPLE\jdoe, or jdoe for a server that requires the local part alone.
• Password is optional. An account with no password in the CSV uses --password, and an account with neither is prompted for by name before anything is deleted.
• To replace a password that has changed, supply the new value in the Password column and run again. A value in the CSV overwrites the one the project holds.

Re-importing and Resuming

• Importing a CSV again does not reset completed work. An item is identified by its ServiceId, TargetEmail, Folder and DriveId together, so a row already in the project is recognized and only new rows are added.
• The same item listed twice is imported only once.
• The Remaining Items Log is a valid input CSV. Every item a remediation could not confirm as deleted is written to it with the same columns, so it can be used as the input of a new project.

Sample CSVs

You can find several example input CSVs on the Examples page.