Question

How can I decrypt Dropbox in FTK?

 

Prerequisites

Windows:

  • Dropbox files (encrypted SQLite files found in "C:\Users\\AppData\Roaming\Dropbox")
  • The user's NTUSER.DAT (found in C:\Users\)
  • The user's "Protect" folder, exported with all of its children, retaining folder structure (found in "C:\Users\\AppData\Roaming\Microsoft")
  • The user's Windows password
  • If the user's account is a Windows Live account, you will also need the machine's SAM file (found in "C:\Windows\System32\config")

Linux & OS X:

  • Full disk image, containing Dropbox files (encrypted SQLite files found in "/Users/Test/.dropbox/") and the hostkeys

 

Procedure

  1. Go to Tools > Decrypt Files
  2. (Windows Only) Click "Set Passwords"
  3. (Windows Only) Enter the user's Windows Password and click "OK"
  4. Check "Dropbox" under "Decrypt File Types"
  5. Click "Decrypt"