Pro plugin

Dropbox

Collects file cache metadata, deleted file records, account configuration, and preferences from Dropbox Desktop encrypted databases

cloudstorage.dropboxPromacOS 10.12+v1.0.0cloud-storageuserfile-access

Run this plugin

Trigger collection for Dropbox on its own with the --plugin flag, or include it in a wider sweep by category.

# Just this plugin
macfor-pro collect --plugin cloudstorage.dropbox --output ./evidence.zip

# Dry run — list what would be collected
macfor-pro collect --plugin cloudstorage.dropbox --dry-run

Compatibility

macOS 10.12+

Licensing: ships in the macfor-pro binary. See Community vs Pro.

Artifacts collected (5)

Each row corresponds to an entry in the plugin's artifacts.yaml manifest. Optional artifacts are skipped unless explicitly enabled.

storage

Artifact	Format	Path	Notes
Dropbox File Cache dropbox_filecachehigh value	sqlite	`~/.dropbox/instance1/filecache.dbx`	Structured file cache records including paths, sizes, timestamps, and sync state.
Dropbox Deleted Files dropbox_deletedhigh value	sqlite	`~/.dropbox/instance1/deleted.dbx`	Deleted file records with original paths and deletion timestamps.

config

Artifact	Format	Path	Notes
Dropbox Account Configuration dropbox_accountSensitivemedium value	sqlite	`~/.dropbox/instance1/config.dbx`	Account configuration including email, display name, and team membership.
Dropbox Preferences dropbox_prefsmedium value	binary_plist	`~/Library/Preferences/com.getdropbox.dropbox.plist`	Application preferences including client version and sync root path.

metadata

Artifact	Format	Path	Notes
Dropbox Raw Files dropbox_rawOptionalOpt-in	binary	`~/.dropbox/instance1/`	Raw .dbx databases and supporting files for offline analysis.