File encryption with AES CTR mode I understand that encrypting files in CTR mode is not perfectly safe, because it potentially leaves the files open for cryptanalysis, if the attacker has access to previous versions of the same files. But is this really feasible when we are talking about encrypting files?

Lets say we got a program that reads and writes encrypted files with AES CTR mode. If we have a word document it will be written to many times, and therefore change alot without the key and counter changing for specific blocks. 

Now how feasible is it really for an attacker to actually find these previous versions on a given harddisk? Should this constellation not be reasonable secure against anyone except maybe the NSA?
There's nothing wrong with using CTR mode to encrypt files, or anything else, as long as you make sure to use every nonce value only once. (And add authentication, if malleability would be a problem.) You could, for example, rewrite the whole file encrypting it with a new random nonce every time it's modified.

Since you are assuming nonce reuse, an attack that used different versions of the file would indeed be simple. How feasible it is depends on how easy those previous versions are to get to, which depends on what sort of threats you envision. An attacker who does see multiple versions does not need NSA-level powers.

Example attacks:


An attacker who can read the encrypted file e.g. daily would be able to just wait until you modify it.
If there are backups or a versioning filesystem, an attacker could find previous versions there.
Access to the raw HDD image might make an attacker able to read previous versions from currently unused parts of the filesystem.


Etc. None of these is really that difficult, if the attacker has proper access.