Is it possible to determine when a file was last encrypted or unencrypted? If so, where would I need to look please? thanks
Is it possible to determine when a file was last encrypted or unencrypted? If so, where would I need to look please? thanks
Yes/No/maybe/who knows. 😯
It depends on the specifics, generally speaking (usually there is no in-place encryption) encryption=creation date/time or modified date/time, but this may not be valid if the creation and/or modification date/time has been changed by other means (like some forms of copying)
Unencryption may be last access time if available (but again that may be influenced by other operations that modify it).
Depending on the program used there may be other traces (logs, either self-standing or in events or in the registry) that the program has been run, there could be a link in "recent" files, etc.
jaclaz
hi @jmundy & @hebihi82
1.    if it is a mountable file/volume like truecrypt/veracrypt u got the following paths to check
2.    HKLM\System\MountedDevices
3.    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2
For any other support join my Telegram channel foreignsikhs
Thank you