How can I find all documents encrypted by a certain application?

Question

I don't think Spotlight can help with this, so I am trying to use the ordinary Command-F(ind).
I know there's a parameter option "Created by [application]" but that doesn't work, even though the Info window shows the Kind as this application.
The specifics:
Under System 9, I encrypted a lot of files (personal correspondence, mainly) using Sentinel 2.2. In other words, I used Sentinel to require a password to open those files.
Now I can't open them, because that program doesn't work with Sys X.
I could open them in Sys 9 and then resave them without the encryption. But I need to find them all.
(I want to handle them all now, rather than over the next few decades when one might pop up now and then. I won't have Sys 9 forever.)
I can't find any perameter option to use (in Find) that will locate these files. I have a suspicion that maybe the reason searching on the creator application doesn't work is because Sentinel didn't technically create the documents, it only encrypted existing documents—although in the Info window, Sentinel is shown as the Kind. If it's any help, also shown in the Info window is the version: "Sentinel 2.2, © 1987-89 Supermac Technology."
Sentinel put it's own icon on all the locked files.
Seems like it should be easy to do a search to find all these files, but I can't figure out how.
Any suggestions?
Thanks.
Larry

Answer 1

You should be able to do it, but first you'll need to get a unique piece of metadata for the files, and then you'll need to use the Raw Query format in the Find window. I have a handy little utility written by a cyber-friend I keep in the Dock for getting the metadata entries for a file, and I think there are other free ones on VersionTracker, but you can also use Terminal to get the relevant entries. Thus I have some old Excel files. To locate all of them, I would do this:
1. Open Terminal (it is in your Utilities folder) and type
mdls
and a space. Then drag and drop one of your files into the Terminal window and hit the Return key. The result will look something like this:
NoobiX:~ francine$ mdls /Volumes/Data/BackUp/8600drives/FastMac/Documents/Finances/Finances1995
/Volumes/Data/BackUp/8600drives/FastMac/Documents/Finances/Finances1995
kMDItemAttributeChangeDate = 2007-08-01 12:15:22 -0700
kMDItemContentCreationDate = 1996-03-13 01:27:46 -0800
kMDItemContentModificationDate = 1996-03-13 02:08:03 -0800
kMDItemContentType = "com.microsoft.excel.xls"
kMDItemContentTypeTree = ("com.microsoft.excel.xls", "public.data", "public.item")
kMDItemDisplayName = "Finances1995"
kMDItemFSContentChangeDate = 1996-03-13 02:08:03 -0800
kMDItemFSCreationDate = 1996-03-13 01:27:46 -0800
kMDItemFSCreatorCode = 1480803660
kMDItemFSFinderFlags = 256
kMDItemFSInvisible = 0
kMDItemFSIsExtensionHidden = 0
kMDItemFSLabel = 0
kMDItemFSName = "Finances1995"
kMDItemFSNodeCount = 0
kMDItemFSOwnerGroupID = 501
kMDItemFSOwnerUserID = 501
kMDItemFSSize = 6954
kMDItemFSTypeCode = 1481397044
kMDItemID = 58528
kMDItemKind = "Microsoft Excel 4.0 worksheet"
kMDItemLastUsedDate = 2007-08-01 12:15:22 -0700
kMDItemUsedDates = (1996-03-13 02:08:03 -0800, 2007-07-31 17:00:00 -0700)
2. Since I want to find all the old Excel files, I chose the line
kMDItemKind = "Microsoft Excel 4.0 worksheet"
You can just drag to select that line with the Mouse, then select copy.
3. In the Find window criterion drop down menu, select Other, then scroll down to Raw Query, select it, and then paste the kMDItemKind line you copied into the open field. That should do it.
Francine
Francine
Schwieder