How can I decrypt Dropbox in FTK?
- Dropbox files (encrypted SQLite files found in "C:\Users\<user>\AppData\Roaming\Dropbox")
- The user's NTUSER.DAT (found in C:\Users\<user>)
- The user's "Protect" folder, exported with all of its children, retaining folder structure (found in "C:\Users\<user>\AppData\Roaming\Microsoft")
- The user's Windows password
- If the user's account is a Windows Live account, you will also need the machine's SAM file (found in "C:\Windows\System32\config")
Linux & OS X:
- Full disk image, containing Dropbox files (encrypted SQLite files found in "/Users/Test/.dropbox/") and the hostkeys
- Go to Tools > Decrypt Files
- (Windows Only) Click "Set Passwords"
- (Windows Only) Enter the user's Windows Password and click "OK"
- Check "Dropbox" under "Decrypt File Types"
- Click "Decrypt"