Blog >> Box

Investigating Box

27/05/2021 Thursday

Box is a cloud computing service that offers file sharing, collaboration, and cloud storage. In addition, it allows users to share information with other users and manage content across devices. Box was founded in 2005 and is available in several platforms such as for Windows, macOS, and several mobile platforms.

Digital Forensics Value of Box Artifacts

Box artifacts provide information about data and files that users upload and share with other users as well as the app configuration. This information is critical during the digital forensic analysis, as it helps us understand the types of artifacts that are likely to remain for digital forensics investigators.

Location of Box Artifacts

In Windows 10 Box artifacts are located at C:\Users\%username%\Box

Structure of Box Artifacts

Box artifact consists of a database and log files. The logs contain information about network connection, the application launch times, file IDs of the files being edited, whether the files were updated successfully, and the user’s action. On the other hand, the database streemfs.db contains information about Box files, cache files, and virtual files.

Analyzing Box Artifacts with ArtiFast Windows

This section will discuss how to use ArtiFast Windows to analyze Box artifacts from Windows machines and what kind of digital forensics insights we can gain from the artifacts.

After you have created your case and added evidence for investigation, at the Artifacts Parser Selection Phase, you can select Box artifacts:

ArtiFast can analyze Box FS Nodes, Preference, Local Items, Items, Local Events, and Logs. For demonstration purposes, all artifacts have been chosen but you have the option to parse artifacts individually as well.

Once ArtiFast parser plugins complete processing artifacts for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Box artifacts in ArtiFast software.

Box FS Nodes Artifact

Box Items Artifact

Box Local Events Artifact

Box Local Items Artifact

Box Logs Artifact

Box Preferences Artifact