Darrell1405

Q: Can Finder find an encrypted PDF file?

I saved a PDF, in Preview, and encrypted it.  I have done this over time and never kept them in a single folder.  Can Finder locate these files? If so, what is the tag, or other attribute is used?

 

Thanks.

iMac, OS X El Capitan (10.11.6)

Posted on Aug 19, 2016 2:20 PM

Close

Q: Can Finder find an encrypted PDF file?

  • All replies
  • Helpful answers

Page 1 Next
  • by Kappy,Helpful

    Kappy Kappy Aug 19, 2016 2:59 PM in response to Darrell1405
    Level 10 (270,175 points)
    Desktops
    Aug 19, 2016 2:59 PM in response to Darrell1405

    Search for .pdf files or search by titles or document keywords.

  • by Darrell1405,

    Darrell1405 Darrell1405 Aug 19, 2016 2:59 PM in response to Kappy
    Level 1 (9 points)
    Desktops
    Aug 19, 2016 2:59 PM in response to Kappy

    Right. But is there a way to find only the encrypted PDFs? 

  • by Kappy,

    Kappy Kappy Aug 19, 2016 3:13 PM in response to Darrell1405
    Level 10 (270,175 points)
    Desktops
    Aug 19, 2016 3:13 PM in response to Darrell1405

    I don't know. If Spotlight can find only encrypted files, I'm not sure how that would be done since the file content is not readable unless it is decrypted. I'm not sure there is any external information that would even indicate a file is encrypted. You might see if this will help with Finder searches:

     

    Get Spotlight to search system files (and more)

     

    1. Enter the search term in the Finder window's search field.
    2. Click the [+] button in the search bar to add a search option.
    3. In the first drop down menu choose Other.
    4. Choose “System Files” from the list that pops up (and check the box to place in drop down menu to avoid this step later,) click on the OK button.
    5. Now back in the Finder choose Include from the second drop down menu.

     

    The above can be modified to add other search criteria. Review the long list to see if there is a criterion for encrypted .pdf files.

  • by tim.rohrer,

    tim.rohrer tim.rohrer Aug 19, 2016 3:29 PM in response to Darrell1405
    Level 1 (36 points)
    Servers Enterprise
    Aug 19, 2016 3:29 PM in response to Darrell1405

    I created two PDFs from the same webpage, but encrypted one of them. I then went to the Terminal and ran various ls and xattr commands. I didn't see any attribute or designator to reflected the encrypted status of the one PDF.

     

    There is a slight difference in the output of xattr, but I do not know what it means. 

     

    com.apple.quarantine: 0002;57b78577;Preview;

    vs.

    com.apple.quarantine: 0002;57b785a4;Preview;

     

    If the numbers are significant, one could write a script to find them. More research needed though. I realize you were asking for a Finder solution. I'm pretty sure that doesn't exist, in part because there are different methods programs use to encrypt files, and Finder wouldn't know all of them. Nor am I sure I want the OS to know...

  • by Kappy,

    Kappy Kappy Aug 19, 2016 3:46 PM in response to tim.rohrer
    Level 10 (270,175 points)
    Desktops
    Aug 19, 2016 3:46 PM in response to tim.rohrer

    Do you know how the PDFs you are looking for were encrypted? Do you not have a key to decrypt the files? Sorry, but I have no specific answer for you. I try to never get involved in encryption. Too risky.

  • by tim.rohrer,Helpful

    tim.rohrer tim.rohrer Aug 19, 2016 5:22 PM in response to Kappy
    Level 1 (36 points)
    Servers Enterprise
    Aug 19, 2016 5:22 PM in response to Kappy

    Sorry, Kappy, not sure if you intended for this reply for me or for the OP?

     

    I don't personally have any encrypted files I'm searching for, but i liked the question and since I didn't see a way to *like* it, I chose to say I have the question too. (as a side note, I like the way StackExchange lets users vote up and star questions they like).

     

    I can see the usefulness of being able to search file systems for encrypted files.

  • by Darrell1405,

    Darrell1405 Darrell1405 Aug 19, 2016 5:21 PM in response to Kappy
    Level 1 (9 points)
    Desktops
    Aug 19, 2016 5:21 PM in response to Kappy

    Kappy:

     

    To encrypt the files, I did a "Save As" in Preview, and selected the "Encrypt" check box, which prompted me for a password.

     

    i thought that maybe since the OS gives you that option, that somehow there's a way to use Finder to sniff them out.

     

    I will try the search suggestion you wrote above. Thank you for taking time to assist.  

  • by Kappy,

    Kappy Kappy Aug 19, 2016 6:01 PM in response to Darrell1405
    Level 10 (270,175 points)
    Desktops
    Aug 19, 2016 6:01 PM in response to Darrell1405

    You can try using Preview's Open Recent option in the File menu to see if they are still listed. I wish I had something more helpful, but afraid that I don't.

  • by dialabrain,Solvedanswer

    dialabrain dialabrain Aug 19, 2016 6:22 PM in response to Darrell1405
    Level 5 (5,845 points)
    Mac App Store
    Aug 19, 2016 6:22 PM in response to Darrell1405

    FWIW, you can find encrypted files using a Finder search. The problem with PDFs is however, some are password protected so you can't modify them but you can open and read them. The PDFs you encrypt with Preview won't open without a password.

     

    To search all encrypted files you can press "Command + F" while in the Finder. Click the drop down menu where it says "Kind" and select "Other…". Then select "Security","Matches" and type "Password". It will find all encrypted PDFs but there doesn't seem to be a way to distinguish ones that need a password to open from those you just can't modify. The ones created with Preview will have an icon with a lock.

  • by dialabrain,

    dialabrain dialabrain Aug 19, 2016 6:27 PM in response to Darrell1405
    Level 5 (5,845 points)
    Mac App Store
    Aug 19, 2016 6:27 PM in response to Darrell1405

    thus…

    Screen Shot 2016-08-19 at 9.25.21 PM.png

  • by tim.rohrer,

    tim.rohrer tim.rohrer Aug 19, 2016 8:01 PM in response to dialabrain
    Level 1 (36 points)
    Servers Enterprise
    Aug 19, 2016 8:01 PM in response to dialabrain

    Well done on revealing the "Kind" of "Other". I overlooked that.

     

    As I'm trying to use it though, I'm getting behavior I do not understand yet. I am not seeing an icon with a lock. For that matter, I'm not even getting the encrypted PDF to show up. I get several other documents that are, as you pointed out, locked for being modified I believe. They open up just fine.

     

    But, this may be a starting point.

  • by VikingOSX,

    VikingOSX VikingOSX Aug 19, 2016 9:20 PM in response to Darrell1405
    Level 7 (20,591 points)
    Mac OS X
    Aug 19, 2016 9:20 PM in response to Darrell1405

    The following, when entered into Spotlight finds the encrypted PDF that was saved within the hour from Preview — as the top hit. The kMDItemSecurityMethod is added to mdls output when encountering an encrypted PDF. The 'c' is just there to ignore case.

    'kMDItemSecurityMethod == "*crypt*"c' && PDF

    and here is the Saved Search for the Finder Find window:

    Screen Shot 2016-08-20 at 12.19.56 AM.jpg

  • by tim.rohrer,

    tim.rohrer tim.rohrer Aug 20, 2016 6:42 AM in response to VikingOSX
    Level 1 (36 points)
    Servers Enterprise
    Aug 20, 2016 6:42 AM in response to VikingOSX

    Excellent.

     

    VikingOSX, do you have a link to a list of these advanced queries? Or did you figure it out by searching developer.apple.com?

     

    This appears to be the correct answer if the OP can change the mark?

  • by dialabrain,

    dialabrain dialabrain Aug 20, 2016 6:45 AM in response to tim.rohrer
    Level 5 (5,845 points)
    Mac App Store
    Aug 20, 2016 6:45 AM in response to tim.rohrer

    FWIW, his method produces the same results as mine. So it really doesn't need changed.

Page 1 Next