Join Us!

Dropbox Forensics (...
 
Notifications
Clear all

Dropbox Forensics (Sync Times)  

  RSS
4Rensics
(@4rensics)
Active Member

Morning / Evening

Does anybody know where and if I can find the dates and times a file is synced with Dropbox.

I've successfully run Magnet Forensics Dropbox Decryptor and got a filecache.db. The main table (file_journal) has a couple of dates (MTIME and CTIME) and these marry up with the modified date on the PC I acquired but the file has a newercreated date.

I have the files in the dropbox folder on the PC, so its all live data I'm working with.

I did some testing on my own Dropbox and the created and modified date are of when I downloaded the image to my PC a couple of days ago?? (19/11/2018) and not today's date. So I synced today, but don't have any details (without imaging my work PC) to show a sync date? Am I missing something obvious?


My PC

Thanks,
4F

Quote
Posted : 27/11/2018 3:03 pm
chad131
(@chad131)
Member

Check the creation times in $Standard_Information vs $File_Name

ReplyQuote
Posted : 27/11/2018 5:04 pm
Share: