lesnoisland.blogg.se - Search for encrypted files

Not all files that are found are True Crypt containers, but you can be sure that all True Crypt containers stored under the selected root folder are found during the scan.

The application scans all files based on the attributes above and reports its findings back in the program interface. You need to accept the terms of service on start before you can use the folder browser to select a root folder for the scan.

The suspect file must not contain a common file header.

The suspect file contents pass a chi-square distribution test.

The suspect file size is at least 19 KB in size (although in practice this is set to 5 MB).

The suspect file size modulo 512 must equal zero.

TCHunt scans a select folder or partition on the computer for the following four attributes that are part of every TrueCrypt volume: While it is possible to analyze each possible container file on a system, it would take a very long time to do so. It is more or less impossible to verify the existence of a True Crypt container without technical help unless the container itself is rather large or placed in a location where it can be easily identified. The program has been designed to show that it is possible to identify those True Crypt containers even if they are reasonable small and disguised by the user. These volumes can have sizes from 19 Kilobytes onwards and completely arbitrary file names and extensions. With True Crypt, it is possible to encrypt a partition of a hard drive, or a specific amount of storage space which is stored in a container file on a storage device. It has been specifically designed to demonstrate the possibility of finding True Crypt volumes even if they are not mounted and well disguised by the user. TCHunt is a small portable application that can be used to find encrypted True Crypt volumes on the system.