±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 0 Overall: 36317
New Yesterday: 0 Visitors: 201

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Dropbox Forensics (Sync Times)

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts

Senior Member

Dropbox Forensics (Sync Times)

Post Posted: Nov 27, 18 15:03

Morning / Evening

Does anybody know where and if I can find the dates and times a file is synced with Dropbox.

I've successfully run Magnet Forensics Dropbox Decryptor and got a filecache.db. The main table (file_journal) has a couple of dates (MTIME and CTIME) and these marry up with the modified date on the PC I acquired but the file has a newercreated date.

I have the files in the dropbox folder on the PC, so its all live data I'm working with.

I did some testing on my own Dropbox and the created and modified date are of when I downloaded the image to my PC a couple of days ago?? (19/11/2018) and not today's date. So I synced today, but don't have any details (without imaging my work PC) to show a sync date? Am I missing something obvious?



Senior Member

Re: Dropbox Forensics (Sync Times)

Post Posted: Nov 27, 18 17:04

Check the creation times in $Standard_Information vs $File_Name  

Page 1 of 1