Dropbox essentially works by backing up files on the cloud, although unlike certain other cloud-based applications, it only does so when a user manually adds a file, rather than automatically updating the contents of a machine. This can be useful for demonstrating intent.

Dropbox forensic techniques work by accessing either the databases left by the Dropbox application on the Windows machine, or by the investigator gaining access to the online Dropbox account and sifting through the files contained within.