±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35997
New Yesterday: 1 Visitors: 164

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Dropbox Forensics (Sync Times)

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

4Rensics
Senior Member
 

Dropbox Forensics (Sync Times)

Post Posted: Nov 27, 18 16:03

Morning / Evening

Does anybody know where and if I can find the dates and times a file is synced with Dropbox.

I've successfully run Magnet Forensics Dropbox Decryptor and got a filecache.db. The main table (file_journal) has a couple of dates (MTIME and CTIME) and these marry up with the modified date on the PC I acquired but the file has a newercreated date.

I have the files in the dropbox folder on the PC, so its all live data I'm working with.

I did some testing on my own Dropbox and the created and modified date are of when I downloaded the image to my PC a couple of days ago?? (19/11/2018) and not today's date. So I synced today, but don't have any details (without imaging my work PC) to show a sync date? Am I missing something obvious?


My PC

Thanks,
4F  
 
  

chad131
Senior Member
 

Re: Dropbox Forensics (Sync Times)

Post Posted: Nov 27, 18 18:04

Check the creation times in $Standard_Information vs $File_Name  
 

Page 1 of 1