The steps to be followed for dropbox forensics are as follows:
- Open your SQLite browser and navigate to: C:\Users\<USERNAME>\AppData\Local\Microsoft\Dropbox. You will find several .db files contained within this folder.
- The most interesting file in the folder is filecache.db. This lists all files and folders within the Dropbox account, as long as they have not been deleted. You can find details of how large each file is in sigstore.db in the same folder. The filecache database is encrypted by default, but this is one of those that can be decrypted by Magnet's Dropbox Decryptor, which will allow you to see not only the file names but also any associated metadata.
- The Dropbox Decryptor will also uncover information from the ...