No, Dropbox is not stealing your files
TLDR: Windows Explorer asks Dropbox whether it should display a green or blue icon for a file. It does this for all files, including those outside of the Dropbox folder.
I woke up to read a blog post claiming that Dropbox accesses all the files in your PC and uploads everything. Due to my work I spend a fair amount of time understanding how the Dropbox desktop application works so a claim like this certainly got my attention. Let’s take a look at what Dropbox does that led some people into assuming it does more than it should.
What happens here is that Dropbox integrates with Windows Explorer in order to display those green and blue icons that tell you whether a file is synced or not.
When displaying the list of files in a folder, Explorer asks Dropbox if it should display one of those icons. Explorer doesn’t care if the file is part of your Dropbox folder or not. It asks that question for every file.
In order to test the claim of that blog post, I created a directory called Acme and a test file called Image.bmp. When opening the folder I could see Dropbox accessing the file.
You can see Dropbox querying information about the file and then querying the directory where that file resides. That’s all. No reading of the file. Actually, these two operations are part of Dropbox calling GetLongPathName, a Windows API used to query the long form of a file’s path.
When Explorer asks Dropbox about a file, the first thing that Dropbox does is to decide if that file is part of the Dropbox folder or not. It does that by looking at the file’s path and comparing it to the path of the Dropbox folder.
In order to do so it queries the long form of the file’s path. This is probably done to overcome an artifact of an old age when filenames were short: limited to 8 characters at most for the name plus 3 for the extension. Because Explorer could refer to that file using the short form of the path, Dropbox queries the long form of the path because it helps with making the comparison easier.
So by looking over the Process Monitor log things are now clear. All that Dropbox does with files outside of the Dropbox folder is to figure out if they are part of the Dropbox folder or not. Nothing more. It doesn’t read them. It doesn’t upload them.
BTW: If you really need to sync folders outside of the Dropbox folder you can give Boxifier a try.