Quite interesting to see how it worked, and useful to get the key for the encrypted logs, to see it what it actually did while running. Back then you could intercept the https connections as well as they hadn't pinned the certificates yet, to get an even fuller picture.

There was nothing obviously nefarious going on back then, but that was quite a few years ago of course.

For examples see pyrasite, code.interact, etc.

If you specifically want to know what files Dropbox reads there are easy ways to observe this, like strace.