Dropbox Forensics (...
 
Notifications
Clear all

Dropbox Forensics (Sync Times)

2 Posts
2 Users
0 Likes
649 Views
4Rensics
(@4rensics)
Posts: 255
Reputable Member
Topic starter
 

Morning / Evening

Does anybody know where and if I can find the dates and times a file is synced with Dropbox.

I've successfully run Magnet Forensics Dropbox Decryptor and got a filecache.db. The main table (file_journal) has a couple of dates (MTIME and CTIME) and these marry up with the modified date on the PC I acquired but the file has a newercreated date.

I have the files in the dropbox folder on the PC, so its all live data I'm working with.

I did some testing on my own Dropbox and the created and modified date are of when I downloaded the image to my PC a couple of days ago?? (19/11/2018) and not today's date. So I synced today, but don't have any details (without imaging my work PC) to show a sync date? Am I missing something obvious?


My PC

Thanks,
4F

 
Posted : 27/11/2018 3:03 pm
(@chad131)
Posts: 63
Trusted Member
 

Check the creation times in $Standard_Information vs $File_Name

 
Posted : 27/11/2018 5:04 pm
Share: