Dropbox

Overview

Dropbox is a frequent vehicle for data exfiltration and an equally frequent target of investigation. The desktop client keeps local metadata in ~/.dropbox/instance1/: a file index, a record of deleted files, and the linked account's configuration. These .dbx files are SQLite databases encrypted with SQLite Encryption Extension (SEE). macfor decrypts and parses them, and also reads the app's preferences plist.

Analysis Tips

• Decryption is built in: On a live system, macfor decrypts the .dbx files itself when the dbx-keygen-macos helper is on PATH. For disk images, a pre-derived key can be supplied instead. Without either, macfor still collects the preferences plist and the optional raw files
• filecache.dbx: Lists the files Dropbox knows about locally, with sizes, timestamps and sync state. Useful for showing what was in the Dropbox folder
• deleted.dbx: Keeps original paths and deletion times for removed files — evidence of cleanup activity
• config.dbx: Identifies the linked account by email and display name, and shows team membership
• Raw copy: Enable the optional raw collection to preserve the whole instance1/ directory for independent analysis

Related Artifacts

• Quarantine Events - Files downloaded from Dropbox shared links may be quarantined
• FSEvents - Corroborates sync activity with file-system events
• TCC Database - Confirms Dropbox had File Provider / Full Disk Access

References

• Dropbox desktop client documentation
• SANS — cloud storage forensics on macOS