Dropbox Forensics (Sync Times)
Morning / Evening
Does anybody know where and if I can find the dates and times a file is synced with Dropbox.
I've successfully run Magnet Forensics Dropbox Decryptor and got a filecache.db. The main table (file_journal) has a couple of dates (MTIME and CTIME) and these marry up with the modified date on the PC I acquired but the file has a newercreated date.
I have the files in the dropbox folder on the PC, so its all live data I'm working with.
I did some testing on my own Dropbox and the created and modified date are of when I downloaded the image to my PC a couple of days ago?? (19/11/2018) and not today's date. So I synced today, but don't have any details (without imaging my work PC) to show a sync date? Am I missing something obvious?
Check the creation times in $Standard_Information vs $File_Name