Using Vault in G Suite - Identifying Users

[fiza]

Some students have downloaded torrent movies into their Google Drives and are watching these in school. So far I have used Vault to search for .mp4 and .mkv files and it returns the name of the file and the owner. Sometimes it shows the owner as a student username so we can identify the account. In some instances the owner is a random gmail, hotmail, yahoo account. Is there any way to identify which school Google drive account the file resides in?

 

i can't block video files as the students do have legitimate needs to watch video files.

 

I want to be able to identify the accounts where these torrent files are so that we can give them a chance to remove them before any sanctions are imposed.

 

Any ideas please?

[Ditto]

Does going to the Drive Audit and searching for the videos there show you any more detail? From memory, when in the Console, Reports -> Audit -> Drive. You might need to click on the Cog to select more fields to display. For the ones that are owned by non domain users, is it that just a link is being store, not the actual file?