Dropbox config.db Forensic Analysis
Short answer
C Config.db stores the local Dropbox installation details, including email IDs, host_id, version, and local path.
Question
Key Takeaways
The core concept is mapping specific forensic artifacts to their corresponding SQLite databases within a cloud application like Dropbox, with the trap being confusion between configuration and caching files.
This question tests knowledge of Dropbox SQLite database files in cloud forensics, specifically identifying which file stores account and configuration details. The correct answer is C because config.db holds the user's email, host_id, version, and local path.
Common mistake: Candidates often select filecache.db, assuming it stores all persistent data, but this file is primarily used for caching file metadata and content hashes, not account configuration.
Expert Analysis
Why the Answer Is Correct
The config.db file is an SQLite database located in the Dropbox cache directory that contains critical configuration information. It explicitly stores the email ID linked to the account, the current application version/build number, the unique host_id assigned to the device, and the local path where the Dropbox folder is mounted. This makes it the primary source for verifying account identity and installation context.
Why the Other Options Are Wrong
host.db typically stores hardware or host-specific identifiers but does not contain the comprehensive account configuration details listed in the prompt. sigstore.db is related to signature verification and integrity checks rather than user account settings. filecache.db is designed to store cached versions of files and their metadata for performance, not static configuration or account linkage data.
Community Comment Notes
Community consensus strongly supports config.db, with users noting that the name 'config' directly implies its role in storing account settings. One commenter referenced SANS material confirming that this SQLite file contains the email address and host_id. Another user validated the choice by explaining that config.db handles the local application version and path information.
Exam Strategy
When analyzing cloud forensics questions, focus on the function of each database file. Configuration files usually hold account credentials and settings, while cache files hold temporary data or file versions.
Frequently Asked Questions
What other Dropbox files are relevant for forensics?
Is config.db always present on the system?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
aqeel1506 👍 1The correct answer is C. config.db. The config.db file stores various configuration settings and information about the local Dropbox installation, including: Account information (email IDs linked to the account) Local application version and build Host ID Local path information Here's a brief overview of the other options: A. host.db: Stores information about the host computer, such as the operating system and hardware configuration. B. sigstore.db: Stores signature data for files in the Dropbox account. D. filecache.db: Stores metadata about files in the Dropbox account, such as file names, sizes, and modification times.
-
Elb 👍 1 Answered CThe "config.db" file contains the configuration for the account (well sure, the name says it all). This SQLite file contains the email address associated with the account, the "host_id" and local path information.
-
Elb 👍 1C > https://www.sans.org/blog/digital-forensics-dropbox/
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.