Re: Identifying Win2K/XP Encrypted Files

From: Simson L. Garfinkel <simsong(at)lcs.mit.edu>
Date: Thu Jan 30 2003 - 07:55:40 EST

Although not guaranteed, encrypted files are files with high entropy that do not have a header indicating that they are a compressed with a recognized format.

Truthfully, this approach will not recognize files that are compressed with unrecognized algorithms. But for all purposes, such files are actually encrypted.

I have written a small program in the past that finds encrypted files. If you wish, I could dig it up and polish it off.

On Wednesday, January 29, 2003, at 12:23 PM, Christopher Howell wrote:

> Does anyone know a slick way to find encrypted files on a running

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Thu Jan 30 08:31:51 2003