0

I'd like to decrypt some EFS-encrypted files, but I do not know how to do that without altering the timestamp. When encrypting/decrypting files, the modified-time is set to the current time. I'd like to preserve the original timestamp, as the file content have not really changed.

Is this possible? Solutions i don't think work

  • copy to/from FAT (timestamp resolution differs)

  • copy to from Samba share (same)

  • programmatically copy original timestamp and reapply after decryption (possible, but need to handle decryption time which may vary)

grojo
  • 419
  • 1
  • 7
  • 18

2 Answers2

0

This might work:

  • Set up a network share on a remote machine with NTFS encryption disabled (run "fsutil behavior set disableencryption 1" ).
  • Copy to/from it
grojo
  • 419
  • 1
  • 7
  • 18
0

This might help, though I haven't tried it myself:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem

NtfsDisableLastAccessUpdate

Type: REG_DWORD

Value: 1

If it doesn't exist you may have to create it.

You may also be able to use this command from the command prompt, with administrate privileges, of course:

fsutil behavior set disablelastaccess

gekkz
  • 4,219
  • 2
  • 20
  • 19
  • I don't think this is related to my problem, I read the following "(NtfsDisableLastAccessUpdate)...Determines whether NTFS updates the last-access timestamp on each directory when it lists the directories on an NTFS volume." – grojo Dec 15 '09 at 07:50