README.txt for ATC-NY Dropbox Reader[tm] ------------------------------------------Copyright (c) 2011 Architecture Technology Corporation. All rights reserved.

Dropbox Reader is a suite of command-line tools for parsing configuation and cache files associated with the Dropbox cloud storage software. See LICENSE.txt for license information. Web site: http://www.cybermarshal.com/index.php/cyber-marshal-utilities/dropbox-reader Please e-mail support@cybermarshal.com or use the 'support' section of the web site above if you've found a problem with the software. Usage ----With a few exceptions, Dropbox Reader operates on Dropbox database files. On Linux and Mac OS X systems, these files are typically stored in the ~/.dropbox directory. On Windows, %AppData%\Dropbox. These are SQLite3 database files. You must have a Python interpreter installed and usable from the command line to use Dropbox Reader. Dropbox Reader has been tested with Python 2.6; it is not compatible with Python 3. Installing Python is not within the scope of this README. The remainder of this README uses Unix conventions for file paths. read_config.py ----The read_config.py script outputs the contents of the config.db file in human-readable form. This includes the user's registered e-mail address, Dropbox identifier, software version information, and list of the most-recently-changed files. Example: $ python read_config.py ~/.dropbox/config.db read_filecache_config.py ----The read_filecache_config script outputs configration information from the filecache.db file. This includes information about shared directories that are attached to the user's Dropbox account. Example: $ python read_filecache_config.py ~/.dropbox/filecache.db read_filejournal.py ----The read_filejournal script outputs information about Dropbox synchronized files stored in the filecache.db file (the "file journal"). This includes local and server-side metadata and a list of block hashes for each Dropbox-synchronized file. Example: $ python read_filejournal.py ~/.dropbox/filecache.db ...

42:

bar.pdf Server path: 31337:/foo/bar.pdf Parent: 31337:/foo Local SJID: 24601 Local size: 58015278 Local mtime: 2010-07-28 20:15:18 Local ctime: 2011-03-31 11:27:05 Is (locally) directory? False Local attrs: {u'__dpl': [u'mac', u'posix']} Local block hash list (SHA256): 815c... bfe5... b4cb... 0346... ... Cached block hash list (SHA256): 0: 815c... 1: bfe5e... 2: b4cb... 3: 0346... ...

... In the example output, the file's ID number in the file journal is "42". If a file is deleted, the file journal entry is removed, but the ID number is not reused. The local file name is "bar.pdf". On the server, file path is "31337:/foo/bar.pdf", which is contained in the directory "31337:/foo". Here, "31337" is a namespace ID. The user's main namespace ID can be found with read_config.py. The namespace IDs for attached shared directories can be found with read_filecache_config.py. The block hash lists are SHA-256 hashes of 4 MB chunks of the file. (The last chunk will be less than 4 MB in most cases.) Dropbox stores the block list two ways: the local_blocklist in the file_journal table; and the block_cache block list, which is built using the block_ref and block_cache tables and the file's ID number. The read_filejournal.py script outputs both block lists, printing the SHA-256 hashes in hex notation. read_sigstore.py ----The read_sigstore script outputs information from the Dropbox sigstore.db file, which is an additional source of block hashes. Example: $ python read_filejournal.py ~/.dropbox/sigstore.db 61e4..., f43b..., 4190..., a06f..., ... 445 492 919 1973

The first column is the block's hash (SHA-256, hex notation). The second column is the size of the block in bytes (decimal notation). The sigstore entries are output in the order they are stored in the database; despite the example output, they are not ordered by size. hash_blocks.py ---The hash_blocks script produces a block hash list for any file. Like Dropbox,

it computes the SHA-256 hashes of 4 MB chunks, outputing the hashes in hex notation. This block hash list can be compared to the block hashes from read_filejournal and read_sigstore. Example: $ python hash_blocks.py ~/Dropbox/foo/bar.pdf 815c... bfe5... b4cb... 0346... ... dropbox_contains_file.py ----The dropbox_contains_file script computes the block hashes (as in hash_blocks) for one or more files and compares the resulting block hash list(s) to the contents of the filecache.db database (as in read_filejournal). It reports which of the specified files, if any, are partially or exactly the same as any of the files listed in filecache.db. Note that this script skips zero-length files and directories. Example: $ python dropbox_contains_file.py ~/.dropbox/filecache.db ~/Dropbox/foo/bar.pdf /Users/xxx/Dropbox/foo/bar.pdf = bar.pdf (#42) In this example, the one specified file exactly matches a block hash list stored in filecache.db. The local path to the file is on the left of the "=". The name on the right of the "=" is the same as the "local file name" from read_filejournal. The number (in this case, 42), is the same as the "file ID number" from read_filejournal. If it had instead been a partial match, the output would look like this: /Users/xxx/Dropbox/foo/bar.pdf ~ bar.pdf (#42) [4 out of 7/12] Where 4 is the number of blocks shared between the two files, 7 is the number of blocks in the specified file, and 12 is the number of blocks in the filecache.db entry. For matching purposes, dropbox_contains_file does not care what order the blocks are in. If two files contain identical 4 MB blocks, but in a different order, dropbox_contains_file will mark them as matching.