Notifications
Clear all

Encryption question

3 Posts
3 Users
0 Likes
1,014 Views
(@jmundy)
Posts: 25
Eminent Member
Topic starter
 

Is it possible to determine when a file was last encrypted or unencrypted? If so, where would I need to look please? thanks

 
Posted : 08/02/2020 9:41 am
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Is it possible to determine when a file was last encrypted or unencrypted? If so, where would I need to look please? thanks

Yes/No/maybe/who knows. 😯

It depends on the specifics, generally speaking (usually there is no in-place encryption) encryption=creation date/time or modified date/time, but this may not be valid if the creation and/or modification date/time has been changed by other means (like some forms of copying)

Unencryption may be last access time if available (but again that may be influenced by other operations that modify it).

Depending on the program used there may be other traces (logs, either self-standing or in events or in the registry) that the program has been run, there could be a link in "recent" files, etc.

jaclaz

 
Posted : 08/02/2020 2:03 pm
(@mrevoluter)
Posts: 14
Active Member
 

hi @jmundy & @hebihi82

1.     if it is a mountable file/volume like truecrypt/veracrypt u got the following paths to check

2.     HKLM\System\MountedDevices

3.     HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

For any other support join my Telegram channel foreignsikhs

Thank you

 
Posted : 23/01/2022 6:16 pm
Share: