Dropbox Databases
Overview
Section titled “Overview”Evidence: Dropbox Databases
Description: Collect Dropbox Synchronization Databases
Category: Applications
Platform: windows
Short Name: drpdb
Is Parsed: No
Sent to Investigation Hub: No
Collect File(s): Yes
Background
Section titled “Background”Dropbox stores synchronization state, file metadata, and account information in SQLite databases (DB and DBX files). These databases track local and cloud file synchronization, sharing, and account details.
Data Collected
Section titled “Data Collected”This collector gathers structured data about dropbox databases.
Collection Method
Section titled “Collection Method”This collector gathers Dropbox database (DB) and DBX files from Application Data and Local directories, collecting sync databases at multiple directory levels.
Forensic Value
Section titled “Forensic Value”Dropbox databases reveal synchronized files, shared folders, account information, file modifications, and deletion history. This is critical for investigating data exfiltration, identifying shared sensitive files, and recovering evidence stored in cloud storage.