﻿SHERLOCKED  V7 31.10.26
A password-protected folder for Windows 10 and 11. Nothing to install.

WHAT IT DOES
- Put files in the "Vault" folder.
- Lock it with a password. Everything in Vault is encrypted into one file,
  "Vault.locked", and the readable Vault folder is removed.
- Unlock it with the same password and the Vault folder comes back, exactly
  as it was (sub-folders, names and dates included).

HOW TO USE IT
1. Unzip this folder wherever you want the vault to live (for example
   Documents, or a USB stick).
2. Double-click "Sherlocked.cmd". The Sherlocked window opens. The
   first time, it makes an empty "Vault" folder next to it.
3. Click "Open the Vault folder" and copy your private files into it.
4. Close any of those files you have open in other programs.
5. Back in the window, type a password twice (8+ characters) and press Lock.
6. To get your files back: double-click "Sherlocked.cmd", type the
   password and press Unlock. The Vault folder opens. When you're done,
   lock it again (you can keep the same password or choose a new one).

IMPORTANT
- There is no back door and no reset. If you forget the password, the files
  cannot be recovered by anyone, including you. Write it down somewhere safe.
- Keep a backup of anything you can't afford to lose. Back up the
  "Vault.locked" file itself: it's safe to copy, email or put on cloud
  storage, because without the password it's unreadable.
- While the vault is unlocked, the files are NOT protected. Lock it when
  you've finished.
- Don't keep the only copy of a file both inside and outside the vault.

HOW SECURE IS IT?
- Encryption: AES-256, with the key made from your password by
  PBKDF2-SHA256 (600,000 rounds, random salt). That makes guessing passwords
  slow. A long password (4+ random words) is much stronger than a short one.
- Integrity: HMAC-SHA256 across the whole file. A wrong password or a
  damaged or tampered file is caught before anything is unlocked, and your
  locked file is never changed by a failed attempt.
- Safety: when locking, the encrypted file is written and then fully read
  back and checked BEFORE the readable copies are deleted.
- Limits: deleted files can sometimes be recovered from a hard drive with
  special tools (much less likely on modern SSDs). Your Windows 11 Pro also
  includes BitLocker, which encrypts the whole drive and covers this.
  Turning BitLocker on for your drive alongside this vault is the strongest
  setup.

FILES
  Sherlocked.cmd       Double-click this to open the window.
  engine\vault.ps1        The window (PowerShell, built into Windows).
  engine\VaultEngine.cs   The encryption engine (compiled by Windows each time it opens).
  Vault\                  Your files, while unlocked.
  Vault.locked            Your files, encrypted, while locked.

IF WINDOWS BLOCKS IT
Windows marks files downloaded from the internet. If the window doesn't open
or Windows shows a warning: before unzipping, right-click the .zip file,
choose Properties, tick "Unblock" at the bottom of the General tab, press OK,
then unzip again.
