Box Sync is a productivity platform that helps mirror Box-saved data to the user’s desktop. Without using a web browser, the user can access and change the content stored on the Box website via the native file browsing interface. Offline connectivity is required for content that synchronizes with the user’s computer.
Box Sync contains information about offline folders and offline accessed folders. This information is critical during forensic analysis, as it helps us understand the types of artifacts that are likely to remain for digital forensics investigators.
In Windows 10 Box Sync artifacts are located at C:\Users\%username%\Box Sync
Box Sync contains two main file types, databases and log files. First, the databases contain information about files and folder in the Box Sync application. The Sync.db database stores information about files that have been synced with Box. Second, log files contain logs about all users’ actions and authentications entries.
This section will discuss how to use ArtiFast Windows to analyze Box Sync artifacts from Windows machines and what kind of digital forensics insights we can gain from the artifacts.
After you have created your case and added evidence for investigation, at the Artifacts Parser Selection Phase, you can select Box Sync artifacts:
Once ArtiFast parser plugins complete processing artifacts for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Box Sync artifacts in ArtiFast software.
Box Sync Preferences Artifact
Box Sync Local Items Artifact
Box Sync items Artifact
Box Sync Logs Artifact