Question 1

Do Dropbox, Box and Share File keep the kind of logs we need?

Accepted Answer

Business and enterprise tiers do: activity logs of views, downloads, edits, shares and deletions with user and timestamp, plus version histories and sharing records (§3): personal and small-business tiers log less and retain shorter, and export capability varies by product. The account's actual tier and retention are established first, and the desktop client corroborates what ever the platform kept.

Question 2

The account has been deleted. Is the evidence gone?

Accepted Answer

Not necessarily: the desktop-client database on every machine that synced it survives the account, naming the files and the account (§4, Example 2 in reverse); the platform provider's server-side records are reachable by process; and collaborators hold their side of every share. The two-record method exists precisely so that a deleted account is not a dead end.

Question 3

Someone shared a folder externally. How do we find out who reached it?

Accepted Answer

From the sharing and activity logs: the link's creation names the creator and time, and: where the platform logs link usage: the access record names who followed it and from where (§5, Example 1's lingering collaborator). Where the platform logs only that a link exists, the "who reached it" question is answered as far as it allows, and the collaborators' own records fill the gap.

Question 4

We found a Dropbox client on a laptop but nobody admits to the account. What now?

Accepted Answer

The local database names the account and lists what it held (§4, Example 2); the network and expense records confirm its use and who paid; and the account is then reached through the party's cooperation once its existence is undeniable, or through process if it is personal. Shadow IT hides in exactly this way, and the end point is where it surfaces.

Question 5

The other side accuses us of leaking through our sharing platform. How do we answer?

Accepted Answer

With the platform's own record: the sharing and activity logs show exactly what was shared, with whom, and who accessed it (§3, §5), and the governance and engagement baseline shows what was sanctioned (Example 3's client-requested delivery). The same log that would prove a leak proves its absence; run the two-record method and let the platform speak.

Question 6

How is this different from One Drive or Google Drive?

Accepted Answer

The principles are the same: platform log plus client artefact, versions, sharing, retention: but the specifics differ per product, and these platforms are far more likely to be unmapped shadow IT and to be used for external collaboration and deal rooms (§2, §7). The examiner reads each on its own terms, and the data-mapping discipline matters more, not less, because nobody put them on the list. cflab. u k · e-disc ove r y. u k ©2026 Computer Forensics Lab Ltd ·cflab.uk ·e-discovery.uk ·info@cflab.uk ·+44 (0)20 7164 6915 Page 15 of 17

Forensic Evidence From Dropbox Box And ShareFile