Follow

How can I decrypt Dropbox in FTK (6.x and newer)?

Created by: Brendan Bone
Created date:
Last Updated date:

Question

How can I decrypt Dropbox in FTK?

 

Prerequisites

Windows:

  • Dropbox files (encrypted SQLite files found in "C:\Users\<user>\AppData\Roaming\Dropbox")
  • The user's NTUSER.DAT (found in C:\Users\<user>)
  • The user's "Protect" folder, exported with all of its children, retaining folder structure (found in "C:\Users\<user>\AppData\Roaming\Microsoft")
  • The user's Windows password
  • If the user's account is a Windows Live account, you will also need the machine's SAM file (found in "C:\Windows\System32\config")

Linux & OS X:

  • Full disk image, containing Dropbox files (encrypted SQLite files found in "/Users/Test/.dropbox/") and the hostkeys

 

Procedure

  1. Go to Tools > Decrypt Files
  2. (Windows Only) Click "Set Passwords"
  3. (Windows Only) Enter the user's Windows Password and click "OK"
  4. Check "Dropbox" under "Decrypt File Types"
  5. Click "Decrypt"
Was this article helpful?
0 out of 0 found this helpful
Have more questions? Submit a request

Comments

Powered by Zendesk