Truehunter

View physical memory as files in a virtual file system for easy memory analysis and artifact access.

The goal of Truehunter is to identify encrypted containers using a fast and memory-efficient method. This approach does not rely on any external dependencies, which enhances its portability.

Truehunter is designed to detect Truecrypt and Veracrypt containers. However, it may also identify any encrypted file that has a 'header' not found in its database. Truehunter performs the following checks: It tests the first 8 bytes of the file against its own database. The file size must be a multiple of 64. Additionally, it calculates the file's entropy. Truehunter is included as part of the BlackArch forensic tools.

Any Python version from 2.7 to 3.7 should work without requiring any additional libraries. Usage: The headers database file will be created upon the first use and can be updated after each scan. Please note that this is not a complete header database; it only includes the first 8 bytes of each file, along with the file extension and date. However, it serves its purpose as a proof of concept (PoC). Fast Scan: This option searches for files where the size modulo 64 equals 0 (indicating block ciphers), identifies files with unknown headers, and checks for occurrences that are less than the MAXHEADER value (default is 3). Default Scan: This option performs a fast scan and calculates the entropy of the identified files to help reduce false positives. Usage: truehunter.py [-h] [-D HEADERSFILE] [-m MINSIZ