[aselzer]

Did the author actually verify this with strace (or the mac/windows equivalent)?

It sounds like he guessed this based on I/O activity of the process. It could be enough to hash the beginning of the files, and compare the rest if a match is found in the database.

[cremno]

Dropbox doesn't read the file content. There is also no proof that Dropbox directly accesses those files.