tiCrypt 2.18.1

File Operations

File operations move data across the boundary between your Vault and a virtual machine's filesystem. The Vault holds individually encrypted files; a VM holds a mounted filesystem. Every transfer described here is a crossing between those two, and each crossing is a point where data changes custody.

Why the boundary exists

The two sides encrypt differently. Vault files are encrypted individually and are decrypted when you download them. A drive is encrypted as a block device and is decrypted when it is mounted. There is no shared filesystem underneath, so data cannot appear on both sides on its own. It has to be transferred, and the transfer is where the re-encryption happens.

Crossing requires permission on both sides. A transfer needs the VM-level file transfer permission to start and the main-system Vault permission to complete. A user who is the Owner of a VM with full permissions inside it will still fail to write to the Vault if they lack the main-system permission to do so. The VM grants the ability to initiate the transfer; the main system gates whether it lands.

That is deliberate, not friction. Data leaving the enclave is exactly the event compliance regimes care about. Making it an explicit, doubly-gated action is what makes it auditable, and it is why there is no transparent sync between the Vault and a running machine.

Before you begin

• The VM is running and you can connect to it.
• You have the VM permission for the direction you need: VM to Vault transfer to move files into the Vault, Vault to VM transfer to move files into the VM. The File Transfer and File Explorer cards open with any one of Files, VM to Vault transfer, or Vault to VM transfer, and viewing a file inside the VM needs Files.
• The VM's home drive is mounted. Until it is, the cards stay disabled.
• You have the corresponding read or write permission in the Vault.

Transfer Files from a Virtual Machine into the Vault

bulk-action

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the virtual machine to transfer files from.
4. Click the File Transfer option in the center.
5. In the new window, drag-and-drop the files from the right panel (the virtual machine) to the left panel (the Vault). Alternatively, select the files in the VM panel and click Transfer to Vault.
6. In the Transfer file-name to the Vault? pop-up, review the Transfer preview and click Transfer.
7. Once done, click Close.

Result:

The task Transferring from vm-name to Vault copies the files into the Vault folder you dropped them on.

Transfer Files from the Vault into a Virtual Machine

bulk-action

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the virtual machine to transfer files to.
4. Click the File Transfer option in the center.
5. In the new window, drag-and-drop the files from the left panel (the Vault) to the right panel (the virtual machine). Alternatively, open the destination folder in the VM panel, select the files in the Vault panel, and click Transfer.
6. In the Transfer file-name to vm-name? pop-up, review the Transfer preview and click Transfer.
7. Once done, click Close.

Result:

The task Transferring from Vault to vm-name writes the files into the VM folder you chose.

The File Transfer window

The File Transfer window reads "Transfer files between My Vault and vm-name". It shows the Vault in one panel and the VM in the other. Change layout switches between a side-by-side and a stacked split; on screens narrower than 1000 pixels the panels start stacked. The window remembers the split sizes and the folders you had open.

When several files are selected, the pop-up title gives their number and total size instead of a file name. A file whose name already exists at the destination is renamed automatically.

Some files are not transferred into a VM:

• Project membership: a file tagged with a project in which your membership is not active is skipped.
• Project compatibility: a file whose project is neither the VM's project nor a parent project of it is skipped.

If the Vault does not have room for the files, the pop-up shows "Upload not allowed: Available space is X bytes but you need Y bytes". Transferring into a group folder in the Vault opens a further Share files? pop-up.

Some drops are refused. The following table describes the messages.

Message	Meaning
You cannot put files here because drive-name is read-only	The destination drive is attached read-only.
You cannot upload files directly to a VM	Files dragged from your computer cannot be dropped on a VM. Upload them to the Vault first.
Cannot move files to the same location	The files are already in the destination folder.
You cannot drag files between different VMs	Files cannot be dragged from one VM to another. Transfer them through the Vault.
You cannot drag files between drives	Inside a VM, files can be moved only within the same drive.
Cannot move folder-name into itself or one of its subfolders	The destination is inside the folder being moved.
You lack permission to transfer files from this VM to Vault	You do not have VM to Vault transfer.
You lack permission to transfer files from Vault to this VM	You do not have Vault to VM transfer.

Transfer files as Admin or Root

Some VM Controllers support elevated file access. On those VMs the running VM panel also shows File Transfer (as Admin/Root) and File Explorer (as Admin/Root). They are enabled only if you have Sudo (Admin) Access and one of the file permissions. They work like the ordinary cards, but every operation runs as the VM's root user, so the VM panel starts at "Root /". In the elevated File Transfer window, the Vault panel also lists VM Drives. On these VMs, Attach/mount drives appears only in the elevated File Explorer.

Confirmations, Errors & Solutions

File Transfer Button is Inactive in Virtual Machine

The File Transfer button is inactive in the Virtual Machines' right panel.

Ask VM Files Permissions from VM Owner

The card stays inactive until the VM's home drive is mounted. If the home drive is mounted, ask the VM owner to allow you to access the VM Files section. Any one of the three permissions below enables the card; each transfer direction needs its own permission.

To Virtual Machine Owner
To allow VM users permissions to VM Files:  

1. In the VMs section, click the virtual machine where you want to update a user's file permissions.
2. Click the VM Settings and Details option in the bottom center.
3. In the new window, select the Users section in the left panel.
4. Next, select the appropriate user, then click the Open full menu button in the top-right panel.
5. Select Edit user access.
6. In the pop-up, set the profile to Custom.
7. Scroll down under Permissions, and tick all the following permissions.
• Files View, preview, and edit files.
• VM to Vault transfer Transfer files to tiCrypt Vault from VM.
• Vault to VM transfer Upload files to VM and create directories.
8. Click Save.

Explore Files in a Virtual Machine

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the virtual machine whose files you want to explore.
4. Click the File Explorer option in the center.
5. Explore the drives and access directories of the virtual machine.

Result:

The File Explorer opens on the VM's file system. The sidebar lists the drives and access directories you can see, and the main area lists the files of the folder you select.

File Explorer layout

The File Explorer header reads "VM /" followed by the path of the current folder. It offers Refresh and, on drives you can write to, New directory. Previous returns to the previous panel.

The sidebar lists Drives & ADs, with Refresh drives and access directories. Managers of the VM who have the VM permission Drives and the system permission Attach drives to VMs also see Attach/mount drives. For more information, see Create and Manage Drives.

The view selector switches between Grid view, Table view, and Compact table view. The table views have the columns Name, Modified, and Size. An empty folder reads "Empty Directory". Hidden files are not shown.

You can move through the list with the keyboard: arrow keys move, Enter opens, Space selects, Ctrl or Cmd adds an item to the selection, and Shift selects a range.

Act on selected files

Select one or more items to see the actions for them:

• View: opens one file. Requires the VM permission Files. Double-clicking a file does the same. An empty file shows "File is empty".
• Rename: renames one item on a drive you can write to. In the Rename item-name pop-up, enter the New Name and click Rename. The name must differ from the current name and from the other items in the folder, is limited to 80 characters, and may not contain any of / \ | " : * ? < > { } or NUL.
• Create symlink: creates a symbolic link to one item on a drive you can write to. In the Create symbolic link for item-name pop-up, enter the Link Name, choose the folder, and click Create symlink.
• Compute disk usage: computes the size of the selected items. The task reads "Scanning files and directories".
• Export annotations: exports the annotations of the selected videos. Shown when a selected file has annotations. For more information, see Advanced Operations.
• Permanently delete: deletes the items from a drive you can write to. The Delete item-name? pop-up warns "This action is permanent and cannot be undone." A folder that contains access directories cannot be deleted.

Deleted VM files cannot be recovered

Permanently delete removes the files from the drive, and the deletion cannot be undone.

Act on folders in the sidebar

Right-click a folder in the Drives & ADs tree to see the actions for it:

• Create subdirectory: in the Create a new subdirectory in folder-name on vm-name pop-up, enter the Directory Name and click Create directory.
• Rename and Delete: rename or delete the folder. Not offered on the root of a drive.
• Unmount and detach: unmounts the drive and detaches it from the VM. Offered on the root of a drive.
• Edit access directory and Delete: edit or delete an access directory. Offered to managers on the root of an access directory.
• Make access directory: turns the folder into an access directory. Offered on folders that are not already inside an access directory. For more information, see Groups and ACLs.
• Compute disk usage: computes the size of the folder.

Confirmations, Errors & Solutions

File Explorer Button is Inactive in Virtual Machine

The File Explorer button is inactive in Virtual Machines' right panel.

Ask VM Files Permissions from VM Owner

The card stays inactive until the VM's home drive is mounted. If the home drive is mounted, ask the VM owner to allow you to access the VM Files section. Any one of the three permissions below enables the card; each transfer direction needs its own permission.

To Virtual Machine Owner
To allow VM users permissions to VM Files:  

1. In the VMs section, click the virtual machine where you want to update a user's file permissions.
2. Click the VM Settings and Details option in the bottom center.
3. In the new window, select the Users section in the left panel.
4. Next, select the appropriate user, then click the Open full menu button in the top-right panel.
5. Select Edit user access.
6. In the pop-up, set the profile to Custom.
7. Scroll down under Permissions, and tick all the following permissions.
• Files View, preview, and edit files.
• VM to Vault transfer Transfer files to tiCrypt Vault from VM.
• Vault to VM transfer Upload files to VM and create directories.
8. Click Save.

Perform an SFTP to VM Transfer from a Local Machine to a Virtual Machine

bulk-action

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the virtual machine to transfer files to.
4. Click the SFTP to VM option in the center.
5. In the Transfer files to vm-name via SFTP pop-up, click Copy to copy the username, password, host, and port to your SFTP client.

Result:

Your SFTP client connects to the VM through the tunnel that the Connect application opened on your computer, at sftp://127.0.0.1 on the port shown.

The SFTP to VM card appears only when the VM offers SFTP and you have the VM permission SFTP Access. It is enabled only if you also have Remote application access, because the connection runs through the same tunnel as the remote desktop. The ⋮ menu next to a running VM in the left panel offers the same action as Open SFTP pathway.

Every time you open the pop-up, tiCrypt sets a new password, so copy it again each time. The pop-up notes: "In order to transfer files you will need an SFTP client. Please note that FileZilla might not work with tiCrypt because of the strict port range requirements." It lists these values, each with a copy button:

• Username: your username on the VM.
• Password: the password for this connection.
• Host: sftp://127.0.0.1.
• Port: the local port of the tunnel.
• LFTP Command: a command for the LFTP client that connects and mirrors a local folder to the VM.
• MAC/Linux SSHFS: a command that mounts your VM home directory on macOS or Linux.
• Windows SSHFS: the network path to enter in Map network drive on Windows.

If the VM does not forward the SFTP port, tiCrypt shows "This VM does not support SFTP". If the tunnel cannot be opened, it shows "Forwarding failed".

info

For the exact LFTP (a command-line file transfer client) and SSHFS commands, visit the Remote File System section.