Separate active work from the retained encrypted copy
An encrypted working archive should have a clear import, unlock, edit, re-lock and export boundary. Files opened for review may become plaintext working copies, previews or application recovery files. Treat those transitions as part of the control, not as invisible software behavior.
The team imports the approved discovery set into a protected locker, tests authentication with a second account, opens representative files, records where applications save changes, then reimports approved revisions and clears temporary working areas under policy.
Run the control in five steps
- 01Create the protected archive from the approved manifest.
- 02Test authentication and access with a representative user.
- 03Document where plaintext appears during review and editing.
- 04Return approved revisions through a controlled import step.
- 05Lock, close and verify the archive before ending work.
Preserve a defensible decision trail
Record locker or archive ID, software version, storage location, import manifest, authorized users, unlock events, working-copy location, revision return, closure check and backup relationship.
Stop and investigate when
- Users edit the only retained copy inside an untested workflow.
- Plaintext working files remain after the archive is locked.
- A password change is assumed to recover an old archive.
State what the control does not prove
Does not replace provider permissions, guaranteed backup, password recovery or enterprise identity management. Validate preservation, authorization, plaintext copies, provider controls and recovery separately.
Legal discovery security questions
Are files always encrypted while open?
Usually applications need usable content; verify the actual working-copy and memory boundary.
Can the working archive replace preservation storage?
No. Keep preservation, working and production purposes distinct.
Sources for this decision
Links support specific control decisions and do not imply endorsement.