I was logged into my personal Gmail account on a work computer, and I forgot to actually log off. A couple days later, another person brought up Google drive on the work computer, and Google already had me logged on. Needless to say, I had some NSFW images and private financial documents on my drive that the individual saw, and reported me for looking at explicit images while at work (which I never did. I would never open my drive myself at work). I do not know how much clicking around my drive they did, but I doubt anything was downloaded. Now, IT is investigating, and I have been suspended. I remotely logged out of all of my Google accounts when I found someone had opened my drive, and deleted any unsafe for work images and private files. However, will IT be able to see what was on my Google drive at the time it was pulled up on the work computer?
There are a lot of things wrong here from an InfoSec standpoint.
- Why are different employees sharing the same workstation login and consequently browser cookies etc?
- Why were you using such an insecure computer to log on to your Google account?
- Why did your coworker not notice they were in somebody else's private files and log out immediately?
- Why is your coworker assuming you were looking at NSFW images and reporting you for it?
- Unless the content was beyond work-inappropriate and legally questionable, or such usage is clearly against the acceptable use policy (AUP), I don't believe it is ethical for your employer to comment on your personal files.. that said, different jurisdictions have different opinions on this.
As for "can they see what's in my drive?" There may be hints in the browser history, cached thumbnails, images or content. Metadata would contain the most recent date and time of the access.
If they were skilled, they might see that Google drive was not used when you were on the machine, but it was used when your coworker and IT was using the machine.
Various enterprise security products can look deeper, but given you're sharing a login, I would be highly surprised if they had anything which could look deeper or record the content of what was seen in your drive. (e.g., Interception proxy or Network recorder)
Despite the lack of these enterprise tools, there's no guarantees of what has been read or changed: an insecure computer with multiple users had authenticated and unsupervised access to your Google account. What was downloaded, copied or looked at is anyone's guess. An enterprise account might have an audit log, but I don't believe any such thing exists for personal accounts.