End-to-End Recording Encryption

Recording encryption is optional and independent of the storage location. Enable it separately in Desktop Recorder and Audio Recorder to protect student-computer-local, downloaded, pending-upload, and external-storage recordings.

How it works

Each recording uses a random AES key wrapped with the active public key. The matching console private key is required for playback.
Normal recording sends only the public key to student computers. Back up the separate desktop and audio keys as DesktopRecorder.key and AudioRecorder.key.
Losing every private-key copy makes the affected recordings unrecoverable.

Configure encryption

Select Encrypt recordings on the appropriate recorder tab.
Click Back up key... and protect the backup with a strong password.
Click Apply settings. New recordings are encrypted whether local or external storage is selected.

Existing recordings

These fixed positions run from left to right in the application. Empty slots do not move the other icons. Hover over the status column for the applicable descriptions.

Recording status icons

Fixed slots in the first, unlabeled recording-list column

Slot	Icon	Meaning
1	▧	Picture or video: the desktop recording format. Audio leaves this slot empty.
2	↓	Down arrow: downloaded to this console — “Downloaded to console”.
3	🔒	Lock: encrypted — “Encrypted”. This does not confirm that the matching playback key is available.
4	☁	Cloud: available on external storage — “On external storage”. This describes the recording location, not Cloud Connection.

For a row containing several recordings, the download and external-storage indicators appear only when every recording has that status. The lock appears if any recording in the row is encrypted.

Select recordings and click Encrypt or Decrypt. Downloading first is not required.
External-storage files are converted directly there. Agent-only files are converted while the student computer is connected.
Manual remote decryption transfers the required private-key material through the authenticated encrypted console-student computer connection for that operation; it is not saved in student computer recorder configuration.
Use Save unencrypted... to export copies without changing stored originals.
Use Encrypt all recordings... to enable encryption and convert accessible console and external-storage archives in the background. Originals are removed only after verification.
Use Decrypt all recordings... to disable encryption and convert accessible archives.

Which encryption action changes what?

Action	Scope and result
Encrypt recordings + Apply settings	Sets encryption for new recordings after Apply settings. Desktop and audio have separate keys and settings.
Encrypt / Decrypt	Converts only the selected accessible recordings in their storage location. Connected Agent files can be converted remotely; external files are converted there. Decryption needs the matching private keys.
Encrypt all recordings... / Decrypt all recordings...	Changes the recorder setting and processes accessible archives in the background, including console, external storage and connected Agents. Offline or failed files are not proof of completion: reconnect and verify them. Check both recorder tabs separately.
Save unencrypted...	Creates unencrypted export copies; the stored originals remain unchanged. Protect the destination because the copy is readable without a recorder key.

Key-management control map — based on the current controls, not an application screenshot

Open the required recorder, then Settings → Advanced → End-to-end encryption. The two recorder tabs do not share a key.
Back up key... saves the current pair to a password-protected .key file. Keep the password and any older key backups. It does not export all retained historical keys.
Import key... restores a pair from its backup and password. Use the recovery procedure below and verify playback of a known old recording before changing keys.
Rotate key... creates a new active pair and retains earlier keys for migration. Back up the new key, apply settings and check migration/playback; rotation cannot recreate a lost private key.

Recording encryption and recovery

Restore a key backup on this console

On a replacement teacher console, first add the relevant computer and configure access to its recording archive. Use the backup for the same recorder and its original backup password. Importing restores one key pair; it does not restore recording files, external-storage profiles, or storage credentials.

Select the relevant computer and open Desktop Recorder for screen recordings or Audio Recorder for audio recordings. Open Settings → Advanced → End-to-end encryption.
Click Import key.... Select the matching backup: the default filename is DesktopRecorder.key for desktop or AudioRecorder.key for audio. A filename alone does not prove that a backup matches an old recording.
In Import key backup, enter the password used when that backup was created. After a successful import, the key status should show Encryption key: Ready on this console or a ready status with retained previous keys.
If Rotate recording encryption key says this is a different key, choose No and check that you selected the intended backup unless you deliberately want to rotate keys. Making a different key active requires the current private key and retains the previous key for recovery.
Click Apply settings to apply the recorder configuration and distribute its active public key. Then perform the playback check below; a ready key status alone does not prove that it matches every older recording.

Check restored playback, including external storage

Select the same computer and recording date, then open a known encrypted desktop recording or select an audio recording and click Play. Confirm that its screen frames or sound can be reviewed. Test each recorder separately because desktop and audio use separate key settings.
For an external-storage recording, select its existing profile in Recording storage: and confirm that its provider, credentials and folder still locate the original archive. Use a recording marked with the cloud and lock indicators. If no console copy exists, the console fetches it from external storage and decrypts a temporary playback copy using the matching key. The encrypted stored original is preserved.
Keep the original recordings and older key backups until the required archives play successfully. Back up key... exports the current key pair only; it is not a bundle of every retained historical key.

If import or playback fails

An incorrect backup password or damaged backup is rejected. Use the original password and an intact copy of the backup; an Agent password is not a substitute.
If import succeeds but playback reports a missing or incorrect key, verify the recorder and the backup that was active when the recording was made. If external retrieval fails, check the storage profile and file availability separately from the key.
Creating a new key or choosing Rotate key... cannot recover recordings whose matching private key has been lost. Without a usable matching private key on a console or in a decryptable backup, those recordings cannot be recovered.

Desktop Recorder · Audio Recorder

Key rotation

Back up both keys, click Rotate key..., save the new backup, and apply settings. The console rewraps each small per-file AES key in the background while retaining previous keys for offline student computers and failed migrations.

External storage configuration