Notifications
Clear all

Dropbox Decryptor

7 Posts
3 Users
0 Likes
1,352 Views
Adam10541
(@adam10541)
Posts: 550
Honorable Member
Topic starter
 

I'm looking at some dropbox data and having an issue getting Magnet's dropbox decryptor to do it's thing.

Jad gives a very good run down on how to use the software here

https://www.magnetforensics.com/decrypting-the-dropbox-filecache-dbx-file-new-free-tool/#respond

However I keep getting an error that says the file cannot be decrypted and is most likely because of the Protect folder I've chosen.

No other hints as to where to go. The Protect folder is the correct one for that user profile so I'm at a bit of a loss as to where to go.

Anyone had similar issues?

 
Posted : 04/06/2014 1:05 pm
MagnetForensics
(@magnetforensics)
Posts: 40
Eminent Member
 

Hi Adam,

Are the files from an XP or Vista system, and is the account a domain account?

Thanks,
Jad

 
Posted : 04/06/2014 6:27 pm
Adam10541
(@adam10541)
Posts: 550
Honorable Member
Topic starter
 

Hi Jad

I sent you an email earlier but will answer here just in case.

The Dropbox is version 1.6.18 from Windows 7, and it appears likely that it's indeed a domain log on.

I have been able to locate the stored domain credentials and it doesn't look like the ones for the user I need are actually cached on the machine.

I may be able to get the domain log on password from the IT people, but assuming I can get that will it be of any use decrypting the .dbx files?

 
Posted : 16/06/2014 9:00 am
MagnetForensics
(@magnetforensics)
Posts: 40
Eminent Member
 

Hi Adam,

Sorry for the late reply, somehow I missed this.

The free tool we have currently doesn't decrypt files from anything beyond Windows Vista, but will soon. There are also some issues with domain accounts but that should be fixed in the next release as well (out soon!).

I'll be in touch over email with updates.

Best regards,
Jad

 
Posted : 18/06/2014 3:40 am
Adam10541
(@adam10541)
Posts: 550
Honorable Member
Topic starter
 

Thanks Jad, I actually have purchased the full version of IEF and I understand that this functionality will be part of that is this correct?

And when you say soon are we talking weeks or months?

This dropbox cache file could be quite critical in a fairly substantial theft of IP job and my client is understandably keen to access the data.

 
Posted : 18/06/2014 5:25 am
MagnetForensics
(@magnetforensics)
Posts: 40
Eminent Member
 

Hi Adam,

Yes, IEF can currently handle Windows 7 Dropbox files.

The updated tool should be ready in the next few days.

Best regards,
Jad

 
Posted : 18/06/2014 7:17 am
(@chad131)
Posts: 63
Trusted Member
 

Jad.

I was wondering if you did any testing with (or plan to support) Dropbox for Business (https://www.dropbox.com/business/features).

I recently had a local (not domain) account on a Win7 box that was using this. The business version allows for 2 accounts (business and personal) and the business version allowed for the admin's to replace the Windows \Users\[username]\Documents with dropbox.

Anyway, tried Dropbox Decrypter and IEF (with a known password), neither was able to parse the dbx files.

 
Posted : 20/06/2014 12:53 am
Share: