Blog >> Dropbox

Investigating Dropbox

04/05/2021 Tuesday

Dropbox is a file hosting service founded in 2007 that offers cloud storage, file synchronization, personal cloud, and client software. Dropbox brings files together in one place by creating a special folder on the user's computer. The contents of these directories are synchronized to the servers of Dropbox and other computers and systems where Dropbox has been installed by the user, keeping the same files up to date on all devices. Dropbox is available for Microsoft Windows, Apple macOS, and Linux computers, and mobile apps for iOS, Android, and Windows Phone smartphones and tablets.

Digital Forensics Value of Dropbox Artifacts

Dropbox file contains information about files that users uploaded and synced to Dropbox, cloud data, and configuration. This information is critical during the forensic analysis process, as it helps us understand the types of artifacts that are likely to remain for digital forensics investigators.

Location of Dropbox Artifacts

Windows 7/10: C:\Users\hp\AppData\Roaming\Dropbox

Structure of Dropbox Artifacts

Dropbox artifacts are stored in SQLite Database files that contains multiple tables. These tables contain information regarding files that users uploaded and synced to Dropbox.

Analyzing Dropbox Artifacts with ArtiFast Windows

This section will discuss how to use ArtiFast Windows to analyze Dropbox artifacts from Windows machines and what kind of digital forensics insights we can gain from the artifacts.

After you have created your case and added evidence for investigation, at the Artifacts Parser Selection Phase, you can select Dropbox artifacts:

Once ArtiFast parser plugins complete processing artifacts for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Dropbox artifacts in ArtiFast software.

Dropbox (WindowsApp) Actions Artifact

Dropbox (Win Apps) Cached Items Artifact

Dropbox (Win Apps) Files Artifact

Dropbox (Win Apps) Folders Artifact

Dropbox (Win Apps) Gallery Items Artifact

Dropbox (Win Apps) Preview Items Artifact

Dropbox (Win Apps) Recent Actions Artifact

Dropbox (Win Apps) Starred Cached Items Artifact

Dropbox Avatar Cache Artifact

Dropbox Items Artifact

Dropbox Non Local Items Artifact

Dropbox Notifications Artifact

Dropbox Recent Actions Artifact

Dropbox Suggested Items Artifact