Forensics tool exposes Dropbox files

Dropbox identities laid bare across Windows, Linux and Mac.

A forensic tool has been released that allows private files on the Dropbox online hosting service to be read.

Its developer, ATC-NY, claims the tool will reveal a user's email address, Dropbox identifier, recent files and shared directories.

Dropbox is a cloud based system that provides a free storage and sharing service from desktops and mobile devices for some 25 million users.

The company claims that it “uses the same secure methods as banks and the military” and prevents its staff from accessing customer data.

But now a new forensic tool, Dropbox Reader, could make it easier for investigators to crack open Dropbox.

The program is a series of six command-line Python scripts that parse Dropbox configuration and cache files using Windows, Mac OS X, and Linux.

ATC-NY described the functions of each Python script:

• read_config: script outputs the contents of the Dropbox config.db file in human-readable form. This includes the user's registered e-mail address and Dropbox identifier, software version information, and a list of the most-recently-changed files.

• read_filecache_config: script outputs configuration information from the Dropbox filecache.db file. This includes information about shared directories that are attached to the user's Dropbox account.

• read_filejournal: script outputs information about Dropbox synchronised files stored in the filecache.db file. This includes local and server-side metadata and a list of block hashes for each Dropbox-synchronised file.

• read_sigstore: script outputs information from the Dropbox sigstore.db file, which is an additional source of block hashes.

• hash_blocks: script produces a block hash list for any file. This block hash list can be compared to the block hashes from read_filejournal or read_sigstore.

• dropbox_contains_file: script hashes one or more files (as per hash_blocks) and compares the resulting block hash list to the files listed in filecache.db (as per read_filejournal) and reports whether the files are partially or exactly the same as any Dropbox-synchronised files.