Trellix DLP – SaaS offers the option to download the Evidence File Decryption Tool. The Evidence Decryption Tool is an offline command-line executable binary file that provides you the ability to decrypt evidence files independently. This tool is specific to customer decryption configurations, it is downloaded as a password-protected zip file. Therefore, Trellix recommends that the tool be secured.
Note
As a prerequisite, it is recommended to install Java version 8 and above to run the syntax command.
To download the evidence file decryption tool:
In ePO - SaaS, go to Menu → Data Protection → DLP Settings → General.
Provide a password and Click Download Evidence File Decryption Tool.
Note
You must enter the same password in order to extract and use the decryption tool.
Extract the tool to a preferred location on the local system.
Note
The Evidence tool cannot be extracted when unzipped using Windows' default Extract All... method. It is recommended that you use third party software such as Winrar or 7-Zip to extract the tool, which support a wide range of encryption.
In the Command Prompt, enter syntax command:
java -jar EvidenceDecryptionTool.jar <input-path> <output-path>.In the
<input-path>, you must specify the absolute path to the evidence file along with the encrypted file, which must have the extension.dlpenc.(Optional) You can rename the decrypted file and store it in a desired location by passing the desired file path and file name as the
<output-path>.Specify the
<output-path>in the following format:<file-path>\<file-name>.<file-extension>, where the.<file extension>must be the same as the original decrypted file along with.dlpencextension.Note
It is required that you download a new version of the Evidence Tool whenever you change the shared password.