ScanLoupe/Guides/Encrypted scans

Encrypted .dcm scans, and the ones that never open

Nearly every scan a modern TRIOS writes is encrypted. That alone does not stop you opening it. A smaller group is locked in a way that no offline tool can undo, and it is worth knowing which one you are holding.

The four kinds of file

Marked	What it is	Opens offline
CA	Older plain file. Same layout as CC.	Yes
CC	Plain file. Raw vertex data, nothing encrypted.	Yes
CE	Encrypted, key derived from the file itself. Typical of a scan straight off the scanner.	Yes
CE, implant library locked	Saved against a licensed implant library. The key is not in the file.	No, and not by any offline tool

There is a fifth marking, CB, described in the format specification. No public sample of one exists, so ScanLoupe rejects it with a clear message rather than guessing at the layout and handing you a mesh that might be wrong.

Why many encrypted scans still open

The encryption on a normal CE file is not protecting the scan from you. The key is built from a fixed value that every writer shares, combined with a hash of one of the file's own properties. Everything needed is in the file, so a reader can work the key out on its own.

Better still, the file carries its own checksum. After decrypting, a correct reader compares what it got against that value. If they match, the result is provably right. If they do not, something is wrong and no mesh should be drawn. ScanLoupe does this check on every CE file before it renders anything.

How to tell which one you have

You cannot, by looking. You find out by trying to open it: the decryption runs, the checksum does not match, and the file is reported as locked rather than opened.

One signal is worth knowing. Scans saved against a licensed implant library, the kind that come out of abutment and implant work, are the ones we have seen fail. A plain arch scan straight off the scanner is far more likely to open.

That is the honest failure. Be wary of any tool that opens one of these and shows you a mesh, because the only way to do that is to skip the checksum and draw whatever the wrong key produced. A wrong mesh in a dental case is worse than no mesh, because it looks plausible.

What to do when you hit one

Ask the practice to export an STL from their own software and send that instead. They can do it without buying anything, it takes a minute, and an STL is what your design software wants anyway.

The canned reply on the home page is written for exactly this message, so you can paste it rather than writing it each time.

Questions

Are 3Shape .dcm files encrypted?

Most modern ones are. The CE schema stores the vertex data encrypted. Every real patient scan in the public sample sets is CE. Plain CA and CC files come from the older ShapeDesigner era, so encryption is the normal case.

How can a tool open it without 3Shape?

For most files the key is derived from the file itself: a fixed base value combined with a hash of one of the file's own properties. No server and no licence is involved, and a checksum in the file proves the result is right.

Why will some encrypted scans never open?

Because the key is not in the file. A scan saved against a licensed implant library is locked to that licence, which lives on the dongle or a local key store. An offline reader has nothing to derive, so no offline tool can open one.

What should I do with a file I cannot open?

Ask the practice to export an STL from their own software. It is faster than any workaround and it is the format your design software wants.