• ID: AF005
  • Created: 25th May 2024
  • Updated: 02nd November 2026
  • Contributor: The ITM Team

File Encryption

A subject encrypts files or directories to prevent investigators or other authorized personnel from accessing their contents during a subsequent investigation. This may involve encrypting documents, logs, collected organizational data, or other files containing evidence of the subject's activities.

 

The subject may use encryption utilities, password-protected containers, or operating system encryption capabilities to restrict access to relevant information, withholding or retaining exclusive control of the decryption credentials. This can obstruct forensic examination, delay evidence recovery, and prevent investigators from establishing the nature or extent of an infringement.