Slashdot Mirror

← Back to Stories (view on slashdot.org)

Forensics Tool Finds Headerless Encrypted Files

Posted by timothy on from the sir-there's-an-anomaly-here dept.

gurps_npc writes "Forensics Innovations claims to have for sale a product that detects headerless encrypted files, such as TrueCrypt Dynamic files. It does not decrypt the file, just tells you that it is in fact an encrypted file. It works by detecting hidden patterns that don't exist in a random file. It does not mention steganography, but if their claim is true, it seems that it should be capable of detecting stenographic information as well."

3 of 374 comments (clear)

  1. Patterns? by causality · · Score: 5, Informative

    It works by detecting hidden patterns that don't exist in a random file.

    I should first say that I'm rather ignorant about encryption but I hope someone will be able to explain this. I was under the impression that any sort of good-quality encrypted data is indistinguishable from completely random data. That seems to directly contradict the ability to determine whether a volume contains encrypted data by means of locating patterns. Is this really a contradiction?

    --
    It is a miracle that curiosity survives formal education. - Einstein
  2. Who Cares? by DomNF15 · · Score: 5, Informative

    The Wikipedia page on TrueCrypt already indicates that the volumes can pretty much be detected since they are always divisible by 512, it's just impossible to PROVE they are TrueCrypt volumes...

    Be enlightened: http://en.wikipedia.org/wiki/TrueCrypt

  3. This is complete BS, and is easy to test by anom · · Score: 5, Informative

    This is complete sensationalist crap. Truecrypt isn't broken, (probably) nor are any of the other programs they possibly claim to have broken.

    This is easy to test for yourselves folks, I just did it in 5 minutes.

    dd if=/dev/urandom of=/home/me/somefile.jpg bs=512 count=10000

    Performing this command and then scanning the resulting file with "File Investigator" results in the file being detected as a headerless encrypted data file.

    Whoever pointed out that they simply identify any randomly filled binary file of a size of a multiple of 512bytes is correct.

    TrueCrypt doesn't use ECB mode, hasn't for some time, etc etc etc. Stop freaking out every time someone claims to have broken it.