Categorizing encrypted data files

1. An apparatus comprising:

a processor;

a memory that stores code executable by the processor to:

receive an encrypted data file comprising encrypted data, the encrypted data file being encrypted with an encrypted cipher using block cipher key length selected to preserve macroscopic artifacts of the data file contents from an encrypted form of the data file, the macroscopic artifacts sufficient to identify a file type of the encrypted data file from encrypted data in the encrypted data file, the file type comprising a category of the encrypted data file; and

determine a data type for the encrypted data file from macroscopic artifacts from the encrypted data of the encrypted data file,

wherein the data type comprises a file type, a file content class, and/or an image class.

2. The apparatus of claim 1 , wherein the code is further executable by the processor to index the encrypted data file based on the data type and present a plurality of indexed encrypted data files that are organized based on the indexing.

3. The apparatus of claim 2 , wherein:

the encrypted data files are indexed into an image category, a video category, a document category, or an audio category; and

the image category includes a people category, an object category, or a landscape category.

4. The apparatus of claim 1 , wherein the data type is determined by an encryption type model trained on training data comprising a plurality of encrypted and/or unencrypted data files and corresponding data types.

5. The apparatus of claim 1 , wherein the data type is determined by identifying the macroscopic artifacts from a pattern search of the encrypted data of the encrypted data file and selecting the data type that corresponds to the macroscopic artifact.

6. The apparatus of claim 1 , wherein the block cipher key length is less than three orders of magnitude of a data file length of the data file.

7. The apparatus of claim 1 , wherein the block cipher key length has a minimum length sufficient to obscure data in the data file for the data type.

8. The apparatus of claim 1 , wherein the data type is determined without access to a cipher key of the encryption cipher.

9. A method comprising:

receiving, by use of a processor, an encrypted data file comprising encrypted data, the encrypted data file being encrypted with an encrypted cipher using a block cipher key length selected to preserve macroscopic artifacts of the data file contents from an encrypted form of the encrypted data file, the macroscopic artifacts sufficient to identify a file type of the data file from encrypted data in the encrypted data file, the file type comprising a category of the encrypted data file;

and

determining a data type for the encrypted data file from macroscopic artifacts from the encrypted data of the encrypted data file,

wherein the data type comprises a file type, a file content class, and/or an image class.

10. The method of claim 9 , the method further comprising indexing the encrypted data file based on the data type.

11. The method of claim 10 , wherein:

the encrypted data files are indexed into an image category, a video category, a document category, or an audio category; and

the image category includes a people category, an object category, or a landscape category.

12. The method of claim 10 , the method further comprising presenting a plurality of indexed encrypted data files that are organized based on the indexing.

13. The method of claim 9 , wherein the data type is determined by an encryption type model trained on training data comprising a plurality of encrypted and/or unencrypted data files and corresponding data types.

14. The method of claim 9 , wherein the data type is determined by identifying the macroscopic artifacts from a pattern search of the encrypted data of the encrypted data file and selecting the data type that corresponds to the macroscopic artifact.

15. The method of claim 9 , wherein the block cipher key length is less than three orders of magnitude of a data file length of the data file.

16. The method of claim 9 , wherein the block cipher key length has a minimum length sufficient to obscure data in the data file for the data type.

17. The method of claim 9 , wherein the data type is determined without access to a cipher key of the encryption cipher.

18. A program product comprising a non-transitory computer readable storage medium that stores code executable by a processor, the executable code comprising code to:

receive an encrypted data file comprising encrypted data, the encrypted data file being encrypted with an encrypted cipher using a block cipher key length selected to preserve macroscopic artifacts of the encrypted data file contents from an encrypted form of the data file, the macroscopic artifacts sufficient to identify a file type of the data file from encrypted data in the encrypted data file, the file type comprising a category of the encrypted data file;

and

determine a data type for the encrypted data file from macroscopic artifacts from the encrypted data of the encrypted data file,

wherein the data type comprises a file type, a file content class, and/or an image class.

19. The program product of claim 18 , wherein the data type is determined by an encryption type model trained on training data comprising a plurality of encrypted and/or unencrypted data files and corresponding data types.

20. The program product of claim 18 , wherein the data type is determined by identifying the macroscopic artifacts from a pattern search of the encrypted data of the encrypted data file and selecting the data type that corresponds to the macroscopic artifact.