TCHunt-ng v1.2 – Reveal encrypted files

TCHunt-ng attempts to reveal encrypted files stored on a filesystem. The program is successful in finding TrueCrypt, VeraCrypt, CipherShed containers, EncFS encrypted files, PGP/GPG encrypted messages, OpenSSH and PEM private keys, password databases, and files made up of random data.

TCHunt-ng is a free software licensed under GPLv3.

Methodology

TCHunt-ng performs following tests against content of a file to determine if it is of interest:

1. Test against a database of well known file-types provided by libmagic.
2. Test the size of a file to be greater than 19 kiB and of modulo 512. The test is performed only in TCHunt compatibility mode.
3. Chi-squared test.

Usage

Usage: tchuntng [options] <file>...

Options:
 -r recursively traverse a directory
 -s show a file's classification
 -T enable TCHunt compatibility mode
 -q quietly treat no results as success
 -x don't cross filesystem boundaries
 -p preserve access time of files analyzed
 -v show version information

More Information: here