Join Us!

Notifications
Clear all

Encryption question  

  RSS
Jmundy
(@jmundy)
New Member

Is it possible to determine when a file was last encrypted or unencrypted? If so, where would I need to look please? thanks

Quote
Posted : 08/02/2020 9:41 am
jaclaz
(@jaclaz)
Community Legend

Is it possible to determine when a file was last encrypted or unencrypted? If so, where would I need to look please? thanks

Yes/No/maybe/who knows. 😯

It depends on the specifics, generally speaking (usually there is no in-place encryption) encryption=creation date/time or modified date/time, but this may not be valid if the creation and/or modification date/time has been changed by other means (like some forms of copying)

Unencryption may be last access time if available (but again that may be influenced by other operations that modify it).

Depending on the program used there may be other traces (logs, either self-standing or in events or in the registry) that the program has been run, there could be a link in "recent" files, etc.

jaclaz

ReplyQuote
Posted : 08/02/2020 2:03 pm
Share: