TCHunt-ng attempts to reveal encrypted files stored on a filesystem. The program is successful in finding TrueCrypt, VeraCrypt, CipherShed containers, EncFS encrypted files, PGP/GPG encrypted messages, OpenSSH and PEM private keys, password databases, and files made up of random data.
TCHunt-ng is a free software licensed under GPLv3.
Methodology
TCHunt-ng performs following tests against content of a file to determine if it is of interest:
- Test against a database of well known file-types provided by libmagic.
- Test the size of a file to be greater than 19 kiB and of modulo 512. The test is performed only in TCHunt compatibility mode.
- Chi-squared test.
Usage
Usage: tchuntng [options] <file>... Options: -r recursively traverse a directory -s show a file's classification -T enable TCHunt compatibility mode -q quietly treat no results as success -x don't cross filesystem boundaries -p preserve access time of files analyzed -v show version information
More Information: here
