Notifications
Clear all

Encryption question

Jmundy
(@jmundy)
Junior Member

Is it possible to determine when a file was last encrypted or unencrypted? If so, where would I need to look please? thanks

Quote
Topic starter Posted : 08/02/2020 9:41 am
jaclaz
(@jaclaz)
Community Legend

Is it possible to determine when a file was last encrypted or unencrypted? If so, where would I need to look please? thanks

Yes/No/maybe/who knows. 😯

It depends on the specifics, generally speaking (usually there is no in-place encryption) encryption=creation date/time or modified date/time, but this may not be valid if the creation and/or modification date/time has been changed by other means (like some forms of copying)

Unencryption may be last access time if available (but again that may be influenced by other operations that modify it).

Depending on the program used there may be other traces (logs, either self-standing or in events or in the registry) that the program has been run, there could be a link in "recent" files, etc.

jaclaz

ReplyQuote
Posted : 08/02/2020 2:03 pm
mrevoluter
(@mrevoluter)
New Member

hi @jmundy & @hebihi82

1.     if it is a mountable file/volume like truecrypt/veracrypt u got the following paths to check

2.     HKLM\System\MountedDevices

3.     HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

For any other support join my Telegram channel foreignsikhs

Thank you

ReplyQuote
Posted : 23/01/2022 6:16 pm
Share:
Share to...