TCHunt: Detect Encrypted TrueCrypt Volumes! ? PenTestIT

TCHunt allows you to search for file with the following attributes:

* The suspect file size modulo 512 must equal zero.
* The suspect file size is at least 19 KB in size (although in practice this is set to 5 MB).
* The suspect file contents pass a chi-square distribution test.
* The suspect file must not contain a common file header.

Source: http://www.pentestit.com/2011/04/27/tchunt-detect-encrypted-truecrypt-volumes/

hypnos infosecurity isit-audits information security services free cloud computing free cloud computing articles