igodwin
cb0c5b4614
od-db-backup.md becomes od/db-backup.md -- the hyphen becomes a slash, so the fetch command is exactly as long to type as before. That mattered: the length of a hand-typed command is the constraint this repo is organized around, and a reorganization that lengthened it would have been a net loss. Scripts deliberately stay flat in scripts/ with their domain prefix. Everything executable in one directory is the set worth reading before it runs, and nesting five files by domain would add characters without adding clarity. Updates every reference: README Contents (now grouped by directory), the layout section, both fetch examples, inter-runbook links, and the .NOTES headers in all five scripts. Verified every markdown link resolves on disk and that Contents and the filesystem agree in both directions. Records the naming rule in CONTRIBUTING so the next file lands correctly. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HwcG1jLs1T425QRMxtjxP7
4.0 KiB
Runbook: Google account — evidence capture + re-entry check
For qualified IT professionals, on systems they are authorized to administer. Provided as-is, without warranty — verify it fits your environment. See LICENSE.
Applies to: A consumer Google/Gmail account, before or after containment. No Workspace admin console required.
Use it for: (a) capturing account state before you change anything, and (b) checking whether anyone got back in after a password reset.
Companion: sec/google-compromise.md — full containment procedure.
Placeholders:
| Placeholder | Meaning |
|---|---|
<ACCOUNT> |
The Google account under review |
<RESET_TIME> |
Date/time of the password reset — the re-entry baseline |
<COMPROMISE_START> |
Earliest known date of compromise |
<EVIDENCE_DIR> |
Folder for screenshots, e.g. Desktop\Account Records |
Rules:
- Sign in once. Gmail keeps ~10 recent-activity entries; re-authenticating pushes older ones off.
- Screenshot everything, including empty results.
- Change nothing until Part C.
- Anything dated after
<RESET_TIME>that isn't you = they got back in.
Part A — do first
1. gmail.com → bottom of inbox → "Last account activity" → Details
→ screenshot 01-signin-list (scroll, second shot if needed)
→ Look for: access after <RESET_TIME>.
2. myaccount.google.com → Security → Recent security activity → See all
→ screenshot 02-security-activity
→ Look for: anything after <RESET_TIME>.
3. Security → Your devices → Manage all devices
→ screenshot 03-devices
→ Look for: any session you didn't sign in.
Part B — export check
4. takeout.google.com → Your exports / Manage exports
→ screenshot 04-takeout — screenshot it even if empty.
→ Takeout copies the whole mailbox in one archive. It is the bulk-exfiltration path.
5. Gmail search: in:anywhere from:google.com
→ screenshot results 05-google-alerts
→ open + screenshot each: Security alert · New sign-in · password changed · "Your data is ready to download"
→ in:anywhere includes Trash and Spam, where these are usually deleted to.
6. Gmail search: in:anywhere after:<RESET_TIME date>
→ screenshot 06-since-reset
Don't delete anything. Don't empty Trash.
Part C — persistence
7. myaccount.google.com/permissions
→ screenshot list 07-oauth
→ open each grant → screenshot name + scopes + date authorized 07b…
→ then remove every grant you cannot positively attribute.
→ Authorized on/after <COMPROMISE_START> = attacker-created.
→ OAuth grants survive password resets and session revocation.
8. Gmail → gear → See all settings:
- Forwarding and POP/IMAP → screenshot
08-forwarding— note any pending/unconfirmed address - Filters and Blocked Addresses → screenshot
09-filters→ select all → Export → save the XML - Accounts and Import → screenshot
10-accounts— Send mail as · Grant access to your account
9. myaccount.google.com/signinoptions/passkeys → screenshot 11-passkeys
→ Any passkey you didn't enroll → remove.
10. Security → 2-Step Verification → screenshot 12-2sv
→ Recovery phone + recovery email → screenshot 13-recovery
11. myaccount.google.com/apppasswords → screenshot 14-apppasswords
→ revoke all. App passwords bypass 2-Step Verification.
Before you leave
- Nothing deleted, Trash not emptied
<EVIDENCE_DIR>left on the machine- Time finished written down
- Screenshots not emailed
Results
| Step | Finding | Screenshot |
|---|---|---|
| 1 | ||
| 2 | ||
| 3 | ||
| 4 | ||
| 5 | ||
| 6 | ||
| 7 | name / scopes / authorized date: | |
| 8 | ||
| 9 | ||
| 10 | ||
| 11 |
Menu wording drifts; the myaccount.google.com/... links are the durable part. If a path doesn't match, navigate from myaccount.google.com → Security and record the path you used.