Title: Detecting Hidden Encrypted Volume Files via Statistical Analysis

Issue Number: Vol. 3, No. 1
Year of Publication: Feb - 2014
Page Numbers: 30-37
Authors: Mario Piccinelli, Paolo Gubian
Journal Name: International Journal of Cyber-Security and Digital Forensics (IJCSDF)
- Hong Kong
DOI:  http://dx.doi.org/10.17781/P001103

Abstract:


Nowadays various software tools have been developed for the purpose of creating encrypted volume files. Many of those tools are open source and freely available on the internet. Because of that, the probability of finding encrypted files which could contain forensically useful information has dramatically increased. While decoding these files without the key is still a major challenge, the simple fact of being able to recognize their existence is now a top priority for every digital forensics investigation. In this paper we will present a statistical approach to find elements of a seized filesystem which have a reasonable chance of containing encrypted data.