I saved a PDF, in Preview, and encrypted it. I have done this over time and never kept them in a single folder. Can Finder locate these files? If so, what is the tag, or other attribute is used?
Thanks.
iMac, OS X El Capitan (10.11.6)
Search for .pdf files or search by titles or document keywords.
Right. But is there a way to find only the encrypted PDFs?
I don't know. If Spotlight can find only encrypted files, I'm not sure how that would be done since the file content is not readable unless it is decrypted. I'm not sure there is any external information that would even indicate a file is encrypted. You might see if this will help with Finder searches:
Get Spotlight to search system files (and more)
The above can be modified to add other search criteria. Review the long list to see if there is a criterion for encrypted .pdf files.
I created two PDFs from the same webpage, but encrypted one of them. I then went to the Terminal and ran various ls and xattr commands. I didn't see any attribute or designator to reflected the encrypted status of the one PDF.
There is a slight difference in the output of xattr, but I do not know what it means.
com.apple.quarantine: 0002;57b78577;Preview;
vs.
com.apple.quarantine: 0002;57b785a4;Preview;
If the numbers are significant, one could write a script to find them. More research needed though. I realize you were asking for a Finder solution. I'm pretty sure that doesn't exist, in part because there are different methods programs use to encrypt files, and Finder wouldn't know all of them. Nor am I sure I want the OS to know...
Do you know how the PDFs you are looking for were encrypted? Do you not have a key to decrypt the files? Sorry, but I have no specific answer for you. I try to never get involved in encryption. Too risky.
Sorry, Kappy, not sure if you intended for this reply for me or for the OP?
I don't personally have any encrypted files I'm searching for, but i liked the question and since I didn't see a way to *like* it, I chose to say I have the question too. (as a side note, I like the way StackExchange lets users vote up and star questions they like).
I can see the usefulness of being able to search file systems for encrypted files.
Kappy:
To encrypt the files, I did a "Save As" in Preview, and selected the "Encrypt" check box, which prompted me for a password.
i thought that maybe since the OS gives you that option, that somehow there's a way to use Finder to sniff them out.
I will try the search suggestion you wrote above. Thank you for taking time to assist.
You can try using Preview's Open Recent option in the File menu to see if they are still listed. I wish I had something more helpful, but afraid that I don't.
FWIW, you can find encrypted files using a Finder search. The problem with PDFs is however, some are password protected so you can't modify them but you can open and read them. The PDFs you encrypt with Preview won't open without a password.
To search all encrypted files you can press "Command + F" while in the Finder. Click the drop down menu where it says "Kind" and select "Other…". Then select "Security","Matches" and type "Password". It will find all encrypted PDFs but there doesn't seem to be a way to distinguish ones that need a password to open from those you just can't modify. The ones created with Preview will have an icon with a lock.
thus…
Well done on revealing the "Kind" of "Other". I overlooked that.
As I'm trying to use it though, I'm getting behavior I do not understand yet. I am not seeing an icon with a lock. For that matter, I'm not even getting the encrypted PDF to show up. I get several other documents that are, as you pointed out, locked for being modified I believe. They open up just fine.
But, this may be a starting point.
The following, when entered into Spotlight finds the encrypted PDF that was saved within the hour from Preview — as the top hit. The kMDItemSecurityMethod is added to mdls output when encountering an encrypted PDF. The 'c' is just there to ignore case.
'kMDItemSecurityMethod == "*crypt*"c' && PDF
and here is the Saved Search for the Finder Find window:
Excellent.
VikingOSX, do you have a link to a list of these advanced queries? Or did you figure it out by searching developer.apple.com?
This appears to be the correct answer if the OP can change the mark?
FWIW, his method produces the same results as mine. So it really doesn't need changed. 😁
Ha! I had just tried to delete that last part of my comment because I realized I was mistaken. :-) But, the system wouldn't let me.
Yes, you are correct. And I think your solution is simpler so it is better in that sense. Nor is it clear if there are any real differences between the two approaches.
Cheers!
Can Finder find an encrypted PDF file?
