An encrypted content transport stream is received by a viewer's device and recorded for subsequent playback. During recording, keys in headers of packets of the stream are stripped and placed in sequence in a table. Also, the table indicates changes in key indicating bits. When it is desired to play the content, start-of-frame indicator bits such as PUSI and/or RAI bits are used to access the table of keys to retrieve the keys necessary to decrypt the transport stream packets sought to be played.