Folder Lock for Incident Evidence | Incident Evidence Kit

Supplied Folder Lock box artwork — **Product identity***Artwork identifies the product family; it does not prove current behavior.*

01 / DECISION

Protect the incident evidence without hiding ownership

Folder Lock may fit selected Windows-based encrypted encrypted working archive workflows after current-version testing. It is not a replacement for provider sharing permissions, evidence platform account identity management, guaranteed backup or guaranteed password recovery. Cloud-related features and compatibility must be verified against the current release and actual environment.

Incident response workflow scenario

An IT administrator preserves the source, creates a verified working copy and records each analyst handoff before sharing the incident bundle.

02 / PROCEDURE

Run the control sequence

01
Verify official source, current release, license and supported Windows environment.
02
Pilot a fictional investigation bundle set before importing incident evidence and supporting attachments.
03
Test locker creation, lock/unlock, reopen and plaintext residue.
04
Test separately stored backup, restore and lost-password consequences.
05
Approve only the verified use; document exclusions and review date.

03 / RECORD

Preserve decision evidence

Record version, installer source, license, Windows environment, archive/locker settings, test manifest, lock/unlock result, residue, backup, recovery result, exclusions and owner.

Stop when

Legacy screenshots are treated as proof of the current release.
The product is used as a collaboration permission system.
No independent recovery copy or restore test exists.

The record should show the approved investigation bundle, tested environment, responsible people and known limitations without storing passwords or unnecessary unrelated personal data, credentials or active malicious content.

04 / BOUNDARY

Separate the surrounding controls

Does not establish authorized IT administrator or incident analyst authority, evidence integrity, forensic soundness, chain of custody or incident authority; it does not replace evidence platform and provider permissions, guaranteed backup, password recovery or evidence platform account identity management. Encryption does not authorize a recipient, preserve every backup or remove plaintext working copies automatically.

PRODUCT EVIDENCE

Inspect the workflow, not the artwork

Supplied legacy Folder Lock main interface — **Main interface***Confirm the current release before relying on visible modules.*

Supplied legacy Folder Lock login screen — **Access screen***Test password and recovery consequences with fictional files.*

Supplied legacy Folder Lock locker interface — **Locker view***Verify exact locker behavior, plaintext residue and reopen results.*

Supplied legacy Folder Lock cloud screen — **Cloud workflow***Cloud artwork does not replace evidence platform and provider permissions or guarantee backup.*

Supplied legacy Folder Lock settings screen — **Settings screen***Settings are version-specific; document the tested configuration.*

Keep the boundary explicit.

Folder Lock does not replace evidence platform and provider permissions, guaranteed backup, password recovery or evidence platform account identity management.

05 / QUESTIONS

Incident evidence questions

Should encryption become the incident evidence system?

No. Keep the authoritative evidence source in the approved incident evidence system and archive named incident evidence deliberately.

Does resetting a password recover an existing archive?

Do not assume so. Document the product-specific recovery boundary and test a separate recovery copy.

06 / SOURCES

Primary references

References support specific boundaries and do not imply endorsement.