File-tool resources: protection, publication and recovery

With files you usually face three separate jobs: protecting them while they are stored, removing identifying information before you publish, and getting back a copy that was lost. You do not need several programs running at once for all three. Pick each tool for the job you actually have.

Full-disk encryption is different from a separate container for a few files; that distinction is in the guide to secure file storage. This page helps you match a few well-known names to the right job, install them from the official path and look at recovery before the day of an incident.

Write down the job first

1. If a file should stay on the same computer, or inside a separate file, and should not be readable without a secret, you are thinking about encryption at rest.
2. If you are publishing the file for other people, review metadata before you send it. Encrypting a container does not strip the author’s name or a photo’s coordinates from the published copy.
3. If you are worried about losing the file, make a tested backup first. An undelete program after the fact is not a substitute.
4. If you are selling or handing over a device, go to sanitizing, not to recovery software.

An encrypted container with VeraCrypt

VeraCrypt is a well-known way to build an encrypted file container: inside it, folders look like an ordinary drive, and outside the program you only see one large file. Get the installer only from veracrypt.fr, not from the first search result or a file in a group chat.

1. After you install, open Create Volume and choose Create an encrypted file container.
2. For most work a Standard VeraCrypt volume is enough. Make the size a little larger than today’s need; growing it later takes planning.
3. Put the container file somewhere your backup will include, but do not store the password in the same folder.
4. Use a long, unique password and keep it off that same computer. If you forget the password, the contents do not come back.
5. To use it, select the file in the program window, pick a free drive letter and choose Mount. After you finish, choose Dismount; do not leave the computer with the volume mounted.
6. Run Backup Volume Header once from Volume Tools and keep that copy separately; damage at the start of the container file can make opening it hard.

A VeraCrypt container is useful when you move or archive several sensitive files together. It does not replace the operating system’s own disk encryption: if the whole disk is not encrypted, other files and temporary copies stay readable.

A cloud-synced folder: Cryptomator

Cryptomator is designed for a folder that syncs with a cloud service. Files open in a vault on the same computer, and what goes to the cloud is in encrypted pieces. Get it from cryptomator.org.

1. After you install, create a new vault and place it inside your cloud-sync folder.
2. Give the vault a unique password. The app usually also gives a recovery key; write that down outside the same cloud folder.
3. Put sensitive files into the vault only while it is unlocked. Do not send the unlocked view to a separate sync.
4. Before you rely on this method, unlock the same vault from a second device and confirm the file comes back.
5. If both the password and the recovery key are lost, the cloud service cannot read the contents for you; that is both the strength of the design and the recovery risk.

Cryptomator is not encryption of the cloud account itself, and it does not protect other folders in that account. Harden sharing links and the account profile separately; the Google-account guide covers that environment on its own.

An encrypted archive with 7-Zip

7-Zip can encrypt an archive with AES and is a common way to send several files in one package. Get the program from 7-zip.org. The names of files inside are not always hidden, and you must send the password through a separate channel, not in the same message that carries the archive.

1. Select the files and open Add to archive.
2. Prefer the 7z format. In Encryption set AES-256 and, if Encrypt file names is available, turn that on as well; that hiding is not always available in the zip format.
3. Choose a unique password and do not write it in the chat that carries the file, on the parcel label or in the archive’s own name.
4. Before you delete the original, open the archive once on the same device or on a second one.
5. An encrypted archive is still a single copy. If that is all you have and it is damaged, there is nothing to restore.

Review metadata before you publish

Encrypting a container or an archive does not remove identifying information from a published copy. An author name, a company, a folder path, an edit date and a photo’s coordinates can stay inside the file. Follow the method in the guide to removing identifying information. To start, the program’s own tools are usually enough.

1. In Word, Excel or PowerPoint open File > Info > Check for Issues > Inspect Document, choose Inspect and remove only the categories you do not want travelling with the file.
2. On a Mac, open the document or image in Preview and use Tools > Show Inspector. If you need a fresh copy to send, export one and inspect that copy.
3. Look at photographs separately: many phones write a location into the file. Check that in the file’s details or with the operating system’s own tools.
4. Do not upload a sensitive file to an unknown site that promises to strip metadata; the upload itself can spread the content.
5. A command-line tool only helps if you know which fields it removes. If you do not check the result, it gives a false sense of safety.

Recovery means a tested backup

The best recovery is a copy you made before an incident and restored once, not a program that promises to revive a file after deletion. How to build that kind of copy is in backups you can restore.

1. Keep important files in more than one place: the working device, and a separate copy that will not fail at the same time.
2. If you use a container or a vault, keep the password or recovery key outside that same container; otherwise the second copy will not open either.
3. Once, in calm conditions, test opening the container, vault or archive on a second device.
4. Check the Recycle Bin or Trash first. Many “deletions” are still there and do not need a rescue tool.

What a rescue program after the fact cannot do

Tools that promise to undelete files often over-claim on SSDs and in cloud storage. On an SSD, TRIM usually takes the data out of reach quickly. In the cloud, the file is either in that service’s trash or already removed on the provider’s side, and a desktop program has no magical access to it.

1. These same tools often copy whatever they find to a new place. If the document was sensitive, that fresh copy is itself a new disclosure.
2. Do not run a deep disk scan on a device you think is already compromised, or in front of people you do not trust.
3. Do not trust software that says “everything comes back”; first look at what kind of file it was and what kind of storage it lived on.
4. If you are selling or handing over a device, use the guide to sanitizing sensitive data, not a recovery program.

Install only from the official path

1. Get VeraCrypt from veracrypt.fr.
2. Get Cryptomator from cryptomator.org.
3. Get 7-Zip from 7-zip.org.
4. After you install, keep updating from the same path and set aside a “plus” or cracked build.
5. If you can, check the signature published on the official site once; a familiar name in an unknown store is not enough.

Common mistakes

• Installing several containers and several compressors at once without ever testing a restore.
• Sending the archive password in the same message that carries the file.
• Assuming that encrypting a container also strips metadata from a published copy.
• Relying on a rescue program instead of a weekly backup.
• Leaving a Cryptomator recovery key or a VeraCrypt password inside the same synced folder.
• Uploading a sensitive document to an online metadata cleaner or a multi-engine scanner.

Keep the secret apart from the file

A container, a vault and an archive only finish the job if their secret travels separately from the file itself. If you put both in one cloud folder or one message, anyone who reaches that folder has both.

1. Write the password in a password manager or on a paper copy in a safe place, not in a text file next to the container.
2. If you must give a colleague the password, use a different channel from the one that carried the file.
3. When shared work ends, change access and the password; do not treat the old secret as permanent.

What to do today

1. Pick one encryption method for files that travel — a container, a cloud vault or an archive — and test opening it once.
2. Inspect metadata with the program’s own tools before you publish a document.
3. Make a real backup this week instead of installing a rescue tool, and write down where its key lives.
4. If you are selling or handing over a device, go to sanitizing rather than installing a file-recovery program.
5. Remove programs that came from an unofficial path today, and from now on keep only the official build of the same tool.