Working internally on an alleged exfiltration case. Obvious deletions of files and file view history are noted, two key files were downloaded and the concern is upload. A decent amount of data was uploaded to OneDrive/sharepoint as seen in srubdb. OneDriveExplorer found empty dbs, how do I find artifacts of OneDrive deletion?