Sanitizer: How to Use

tobihagemann · July 21, 2017, 6:16pm

Sanitizer is a tool which can detect problems in Cryptomator vaults and restore lost data.

Currently, Sanitizer is only available as a console application. Eventually, we will integrate it into Cryptomator. For now, follow the instructions on how to use Sanitizer.

Java Installation

At first, you need to have Java 9 or newer. The latest version of Java can be found here.

To verify you meet the minimum required Java version, you can simply invoke the following command via your command line interpreter:

java -version

Running Sanitizer

Now you need to download the Sanitizer jar file. Afterwards you can run Sanitzer.

To do that on Windows, open the command prompt (Start Menu > Enter “cmd” and press enter) and enter the following command:

java -jar C:\path\to\sanitizer-0.15.jar check -vault C:\path\to\vault -deep

Replace the paths C:\path\to\sanitizer-0.15.jar and C:\path\to\vault accordingly. You can open an Explorer window and drag and drop the JAR file and vault directory into the command prompt to insert the correct path.

This video shows how to do that on macOS.

After running Sanitizer, the files *.structure.txt and *.check.txt are created. Those files contain some information about your vault (a list of the (encrypted) files and a problems report).

Advanced Usage

If you’re looking for a way to restore missing file extensions after using the decryptVault command, please read this guide: Sanitizer: Restore Missing File Extensions

thowa1 · November 6, 2018, 5:02am

Java 9 issue:
The current default install (at least for Windows 10 64 bit) seems to be 1.8.0_191 (that is JavaSE8)
The next higher I can find is Java SE 11 - but only the JDK, no JRE.
https://www.oracle.com/technetwork/java/javase/downloads/index.html

How to make Sanitizer run…?

overheadhunter · November 6, 2018, 9:34am

You can use any higher JRE or JDK. I.e. JDK11 is fine.

thowa1 · November 7, 2018, 4:28am

Thanks for the quick reply.
There seems to be no installer for Java >8 and the manual install of the currently downloadable SE11 seems to require some effort and expertise.
I found an installer for Java SE 10 on our intranet via our comporate softwarecenter and the Sanitizer now works for me.
If somone can point to a public downloadable executable installer for Java 9 or higher, that would be helpful for others while Oracle is stll pointing to Java 8 as the default.

overheadhunter · January 10, 2019, 12:15pm

You can find the latest version of the OpenJDK here.

NTWarrior · March 14, 2019, 9:33am

Is there still a support email address we can send the logs to as in the OP? I can’t see the address on your site, and I would rather not put the logs up on the forum or GitHub publicly.

thowa1 · August 4, 2020, 5:58pm

I get “Check failed: Vault version mismatch. Expected: 6 Actual: 7” with Cryptomator 1.5.4 (exe-166) being installed on Windows.
Seems the sanitizer is not yet able to handle the new vault format?
Would be worth a hint in the description if true - if not, what am I doing wrong?

Michael · August 5, 2020, 4:37am

That’s correct.
There are plans to integrate similar functions into the desktop app.

github.com/cryptomator/cryptomator

Built-in Diagnostic Tool (formerly known as Sanitizer)

opened 10:22AM - 27 May 20 UTC

closed 04:09PM - 01 Jun 21 UTC

tobihagemann

type:feature-request

### Summary With a diagnostic tool, Cryptomator will be able to check the "heal…th" of a vault. This works similarly to the [Sanitizer](https://github.com/cryptomator/sanitizer) project but will be built-in for more convenience. ### Motivation The location of a Cryptomator vault is not a controlled environment. Basically, "anything" could happen to the encrypted files. Files and/or folders could be renamed due to sync conflicts. Even file contents could be malformed without Cryptomator's control that make encrypted contents unreadable. Of course, if users deliberately changes these files, they will expect that the decryption is erroneous. But in most cases, changes happen without the users' awareness. A diagnostic tool should be able to guide users to detect or even solve problems with the vault. If users are unable to solve these problems on their own, they at least would have a diagnostic report at hand so that others could have a look at it. ### Proposal To keep things easy as a first step, the diagnostic tool should only be able to perform a check on the vault without solving any problems or other specific commands. Therefore, the feature set is smaller than Sanitizer in the initial implementation. #### Check Vault This command should detect problems in Cryptomator vaults that are related to the directory structure and filenames. 1. Check the existence of `masterkey.cryptomator` and confirm the password before proceeding. 2. Make a directory listing of the vault root and list all names that do not match `d` and `masterkey.cryptomator(.*)`. Check the existence of `d` before proceeding. * Reasoning is to find directories like `d (1)` that could exist due to sync conflicts. 3. Recursively traverse through `d` from a cleartext perspective. Begin with cleartext root `/`. 1. Resolve ciphertext path from cleartext path. 2. Check the existence of the ciphertext path. 3. Make a directory listing of the ciphertext path and check each item name against the expected pattern. * If it matches the expected pattern: * Try to decrypt ciphertext name. If it's a shortened filename, resolve it first. * If it's a `.c9r` directory, make a directory listing, log any unexpected items, and check if it's only a directory or only a symlink. * If it's a `.c9s` directory, check its consistency as well. * If it doesn't match the expected pattern: * Log ciphertext filenames because these files would be ignored by Cryptomator. (Do not consider the ciphertext filenames that would potentially be resolved by Cryptomator via the conflict resolver. Or maybe do if it's feasible.) 4. Collect the ciphertext path in a list for step 4. 5. Repeat from step 3.i for all cleartext directories that have been found. 4. Recursively traverse through `d` from a ciphertext perspective. Log the folders that have not been checked in step 3. * It's debatable if it would make sense to check these files even further. It's probably enough to log the folder names that they are unreachable from a cleartext perspective. The purpose of step 3 is to check if everything is consistent based on what Cryptomator would actually "see". The purpose of step 4 is to check if there are any other items inside the vault that would be ignored by Cryptomator but may still contain encrypted data that a user would like to access. #### Check Vault (Deep) This command should extend the previous command in step 3.3 by also checking the file contents' integrity.

sth2258 · October 7, 2020, 1:32am

Hi - Any chance there will be an update to Sanitizer? I’ve lost closed to 50 GBs of data due to lovely OneDrive and cannot use the current version due to the “Check failed: Vault version mismatch. Expected: 6 Actual: 7” issue

pascal06 · January 13, 2021, 9:16pm

Murphy’s law is coming always when you don’t want it, I just lost a very important file in my vault, maybe by corruption. I just discovered “Sanitizer”, but down on one’s luck I doesn’t work with last vault version.
Is there a way to downgrade a vault and then repair it with Sanitizer ?
Thanks a lot in advance.

pascal06 · January 14, 2021, 12:38pm

Hello,
I downloaded sanitizer souce code. Maybe I can help to a dirty modification that can work with version 7 vault. I’m not a Java fan neither specialist (I learned that 6 years ago at school), but I understand a little.
I really need to know if I can rescue my file

cryptwo · March 15, 2022, 10:28pm

Sorry for dredging up an old thread (in my defense, it is near the top of the list of “all time” threads).

Is it correct that the Sanitizer function has been incorporated into the “Health Check” of the Windows Desktop version? (I have version 1.6.5)

Michael · March 16, 2022, 6:16am

Yes that’s correct.
Cheers