TCHunt: Detect Encrypted TrueCrypt Volumes!

ccf6d14dee5ae28a638fbbbbb0a009a2 TCHunt: Detect Encrypted TrueCrypt Volumes!
As we know, TrueCrypt is a free and open-source disk encryption software for Windows 7/Vista/XP, Mac OS X, and Linux. It does so by creating a virtual encrypted disk within a file and mounts it as a real disk. The reason we are mentioning aboutTrueCrypt is because of TCHunt – an open source application to detect most encrypted TrueCryptvolumes.
Since TrueCrypt is very stable and does it’s job as it says, it is used by almost everyone who wants to deny unauthorized access to their data. It allows you to use keyfiles that stop basic keyloggers, supports automatic unmounting after timeouts, etc. However, this also brings in the “bad guys” who hide behind such legitimate software to protect themselves. It does become really difficult while forensically investigating a TC encrypted drive. This is where TCHunt comes in handy. TCHunt allows you to search for file  with the following attributes :
  1. The suspect file size modulo 512 must equal zero.
  2. The suspect file size is at least 19 KB in size (although in practice this is set to 5 MB).
  3. The suspect file contents pass a chi-square distribution test.
  4. The suspect file must not contain a common file header.
TCHunt also seems very robust. Only, if a volume happen to be created with a common file header, then TCHunt would not find that volume. Even if someone were to rename your encrypted TrueCryptvolumes and hide them among millions of files of similar size, file extension, modification time, etc., TCHunt would quickly and accurately find the actual encrypted volumes! That’s not all! TCHunt completely ignores file names and file extensions. Owing to this, TCHunt can still find encrypted volumes that lack file extensions or have fictitious file extensions! You can employ TCHunt to locate encrypted sparse volumes and encrypted hidden volumes too!
TCHunt can run on Windows XP or newer Windows operating systems. Best of all, it is a self-contained, standalone program, that does not need any additional dependencies and can be used from a floppy disk, USB drive or CD/DVD! Just take care while compiling from the source code that you link the source with boost and FLTK libraries.
Download TCHunt v1.5 (TCHunt-1.5-en.exe/TCHunt-1.5-en.linhere.



Related Posts Plugin for WordPress, Blogger...