How to Use Google Workspace Drive Audit Log to Track File Downloads

If an employee announces their resignation to join a competitor, it is common for IT departments to investigate whether that employee took proprietary company data with them. While you cannot see what they did on their personal home computer, if your company uses Google Workspace, you have a complete forensic trail of their activity within Google Drive. By utilizing the Drive Audit Log in the Admin Console, you can track exactly which files a user viewed, edited, shared, or downloaded in the days leading up to their departure.

Step 1: Access the Drive Audit Log

To access these logs, you must have an administrator account with the necessary reporting privileges.

1. Log in to the Google Workspace Admin Console (admin.google.com).
2. In the left-hand navigation menu, go to Reporting > Audit and investigation > Drive log events.

By default, this page displays every single Drive action taken by every user in your organization over the last few hours. In a large company, this will be an unreadable flood of data. You must use the filtering tools.

Step 2: Filter by the Specific User

We want to isolate the activity of the departing employee.

1. Click the Add a filter button.
2. Select Actor.
3. Type the email address of the employee (e.g., [email protected]) and press Enter.
4. Click Search.

The log will now only show actions performed by John Doe.

Step 3: Filter by Event Type (Downloads)

While seeing what John viewed is interesting, we are primarily concerned with data exfiltration. We need to know what he saved locally to his hard drive.

1. Click Add a filter again.
2. Select Event.
3. In the dropdown, uncheck all options, and check only Download.
4. Click Search.

You now have a highly specific list of every file John downloaded. Pay close attention to the Date column. A spike in downloads (e.g., downloading 500 files on a Sunday afternoon) is a massive red flag.

Step 4: Analyze External Sharing

Downloading isn’t the only way to steal data. An employee might simply share a highly confidential Google Doc with their personal Gmail account.

1. Modify your Event filter. Uncheck “Download” and check Change user access.
2. Add a third filter. Click Add a filter > Target user.
3. Change the condition from “is” to Does not contain.
4. Type your company’s domain (e.g., @company.com).
5. Click Search.

This powerful query shows you every time John Doe shared a file with an email address outside of your corporate domain. If you see a personal Yahoo or Gmail address in the Target User column, you can click on the Document ID to see exactly which file was compromised.

Step 5: Exporting the Data for Legal Review

If you uncover evidence of intellectual property theft, HR or the legal department will need a copy of this data.

1. In the top right corner of the audit log screen, click the Export button (it looks like a downward arrow).
2. Choose a name for the export.
3. The system will generate a comprehensive Google Sheet containing the filtered data, including timestamps, file IDs, IP addresses used during the action, and the specific event details. You can then share this locked spreadsheet with your legal counsel.