Skip to content
Workspace Forensics

This tool is not affiliated with, endorsed by or sponsored by Google LLC. Google Workspace, Gmail and Google Drive are trademarks of Google LLC. Other names are trademarks of their respective owners.

Glossary

Google Takeout

Google's self-service export of an account's data (mail, Drive, calendar…) as downloadable archives; a fast exfiltration path.

Google Takeout lets a user export a copy of their account data, such as Gmail, Drive, Calendar and Contacts, as archives to download or save elsewhere. For Workspace, admins can allow or block it per organizational unit or group. By default it is allowed.

For an attacker holding a session, Takeout is a one-click way to take everything. The Takeout log (available in some editions) records exports being started, completed and downloaded. Completion can lag by days for large exports.

See: Drive mass download and Takeout exfiltration.

This tool is not affiliated with, endorsed by or sponsored by Google LLC. Google Workspace, Gmail and Google Drive are trademarks of Google LLC. Other names are trademarks of their respective owners.