@Override
    public ObjectMetadata getObjectSecurely(GetObjectRequest getObjectRequest,
            File destinationFile) {
        assertParameterNotNull(destinationFile,
        "The destination file parameter must be specified when downloading an object directly to a file");

        S3Object s3Object = getObjectSecurely(getObjectRequest);
        // getObject can return null if constraints were specified but not met
        if (s3Object == null) return null;

        OutputStream outputStream = null;
        try {
            outputStream = new BufferedOutputStream(new FileOutputStream(destinationFile));
            byte[] buffer = new byte[1024*10];
            int bytesRead;
            while ((bytesRead = s3Object.getObjectContent().read(buffer)) > -1) {
                outputStream.write(buffer, 0, bytesRead);
            }
        } catch (IOException e) {
            throw new SdkClientException(
                    "Unable to store object contents to disk: " + e.getMessage(), e);
        } finally {
            closeQuietly(outputStream, log);
            closeQuietly(s3Object.getObjectContent(), log);
        }

        /*
         * Unlike the standard Amazon S3 Client, the Amazon S3 Encryption Client does not do an MD5 check
         * here because the contents stored in S3 and the contents we just retrieved are different.  In
         * S3, the stored contents are encrypted, and locally, the retrieved contents are decrypted.
         */

        return s3Object.getObjectMetadata();
    }
Adjusts the retrieved S3Object so that the object contents contain only the range of bytes
desired by the user.  Since encrypted contents can only be retrieved in CIPHER_BLOCK_SIZE
(16 bytes) chunks, the S3Object potentially contains more bytes than desired, so this method
adjusts the contents range.

@param s3object
     The S3Object retrieved from S3 that could possibly contain more bytes than desired
     by the user.
@param range
     A two-element array of longs corresponding to the start and finish (inclusive) of a desired
     range of bytes.
@param instruction
     Instruction file in JSON or null if no instruction file is involved
@return
     The S3Object with adjusted object contents containing only the range desired by the user.
     If the range specified is invalid, then the S3Object is returned without any modifications.
aws-java-sdk-s3/src/main/java/com/amazonaws/services/s3/internal/crypto/v2/S3CryptoModuleAE.java