GitHub - stephenjudge/TCHunt: Quickly find encrypted files and files made-up of random data

stephenjudge / TCHunt Public

Notifications You must be signed in to change notification settings
Fork 5
Star 22

Quickly find encrypted files and files made-up of random data

16s.us/tchunt/

GPL-3.0 license

22 stars 5 forks Branches Tags Activity

Star

Notifications

Branches Tags

Name		Name	Last commit message	Last commit date
Latest commit History 9 Commits
TCHunt.cpp		TCHunt.cpp
gen_tc.py		gen_tc.py
license.txt		license.txt
linux_build.sh		linux_build.sh
make_tc.sh		make_tc.sh
readme.txt		readme.txt
windows_build.sh		windows_build.sh

Repository files navigation

* Quickly find encrypted TrueCrypt files and other files made-up
  of random data that have the four (4) TCHunt attributes.

* The four (4) TCHunt attributes:

   1. The suspect file size modulo 512 must equal zero.
   2. The suspect file size is at least 19 KB in size (although in practice this is set to 5 MB).
   3. The suspect file contents pass a chi-square distribution test.
   4. The suspect file must not contain a common file header.

* As of version 1.5a, TCHunt is distributed solely under the GPL software license.

* To compile TCHunt, you need the boost and FLTK libraries. I link statically
  and you should consider doing that as well. Read the build scripts to see how
  I compile TCHunt.

* Visit the TCHunt homepage for more details:

   http://16s.us/TCHunt/

END