{"id":13791256,"url":"https://github.com/antagon/TCHunt-ng","last_synced_at":"2025-05-12T10:31:27.637Z","repository":{"id":83236755,"uuid":"71215696","full_name":"antagon/TCHunt-ng","owner":"antagon","description":"Reveal encrypted files stored on a filesystem.","archived":false,"fork":false,"pushed_at":"2018-11-09T18:01:15.000Z","size":5069,"stargazers_count":52,"open_issues_count":4,"forks_count":8,"subscribers_count":5,"default_branch":"master","last_synced_at":"2024-08-04T22:15:24.486Z","etag":null,"topics":["cryptography","encryption","forensics","security","truecrypt"],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/antagon.png","metadata":{"files":{"readme":"README.md","changelog":"ChangeLog","contributing":null,"funding":null,"license":"COPYING","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2016-10-18T06:24:27.000Z","updated_at":"2024-07-21T01:02:07.000Z","dependencies_parsed_at":"2023-03-01T06:30:28.355Z","dependency_job_id":null,"html_url":"https://github.com/antagon/TCHunt-ng","commit_stats":null,"previous_names":[],"tags_count":4,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/antagon%2FTCHunt-ng","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/antagon%2FTCHunt-ng/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/antagon%2FTCHunt-ng/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/antagon%2FTCHunt-ng/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/antagon","download_url":"https://codeload.github.com/antagon/TCHunt-ng/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225133745,"owners_count":17426056,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cryptography","encryption","forensics","security","truecrypt"],"created_at":"2024-08-03T22:00:57.985Z","updated_at":"2024-11-18T05:32:12.612Z","avatar_url":"https://github.com/antagon.png","language":"C","funding_links":[],"categories":["Tools"],"sub_categories":["Encryption / Obfuscation"],"readme":"# TCHunt-ng\n\nTCHunt-ng attempts to reveal encrypted files stored on a filesystem. The program is successful in finding ***TrueCrypt***, ***VeraCrypt***, ***CipherShed*** containers; ***LUKS***, ***EncFS***, ***PGP/GPG*** encrypted files; ***OpenSSH*** and ***PEM*** private keys; password databases; files made up of random data. The code is based on ideas laid out in the project of Stephen Judge named *TCHunt*, hence the name. The original code has aged badly, having unnecessary dependencies and unfixed bugs. A rewrite seemed like a good idea.\n\nTCHunt-ng is a free software licensed under **GPLv3**.\n\n## Methodology\n\nTCHunt-ng performs following tests against content of a file to determine if it is of interest:\n\n1. Test against a database of well known file-types provided by *libmagic*.\n2. Test the size of a file to be greater than 19 kiB and of modulo 512. The test is performed only in *TCHunt compatibility mode*.\n3. *Chi-squared test*.\n\n## Usage\n\n\tUsage: ./tchuntng [options] \u003cfile\u003e [file ...]\n\t\n\tOptions:\n\t -p  preserve access time of files analyzed\n\t -q  quietly treat no result as success\n\t -s  show a file's classification\n\t -T  enable TCHunt compatibility mode\n\t -v  show version information\n\t -h  show usage information\n\n### Examples\n\nTest a single file:\n\n\t$ tchuntng ./test/samples/message.txt.asc\n\nTest multiple files located in the same directory:\n\n\t$ tchuntng ./*.*\n\nTraverse a directory tree testing all the files:\n\n\t$ find ./ -type f | tchuntng -\n\n## Environment\n\nThe behavior of TCHunt-ng is affected by the following environment variables.\n\nThe environment variable MAGIC can be used to override default magic file name. Please note that doing so may affect other programs that rely on *libmagic*.\n\n## Exit status\n\nTCHunt-ng exits with one of the following exit codes:\n\n* `0` - content of a file is *likely* to be encrypted.\n* `1` - a generic error occured.\n* `2` - content of a file is not encrypted.\n* `3` - interrupted by a signal.\n\n## Dependencies\n\n* libmagic \u003e= 5.0\n\n* glibc \u003e= 2.0\n\n## Installation\n\nOn Ubuntu:\n\n\tsudo apt-get install libmagic-dev\n\nOn Fedora:\n\n\tsudo dnf install file-devel\n\nCompile the source code and install the executable:\n\n\tmake \u0026\u0026 sudo make install\n\n## Limitations\n\nTCHunt-ng has no way to tell apart a genuinely encrypted file and a file made up of random data. Files smaller than 32 bytes, unless recognized by its type, are ignored.\n\n## References\n\nhttps://github.com/stephenjudge/TCHunt\n\nhttps://github.com/file/file\n\nhttps://en.wikipedia.org/wiki/Chi-squared_test\n\nhttp://forensicswiki.org/wiki/TrueCrypt#Detection\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fantagon%2FTCHunt-ng","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fantagon%2FTCHunt-ng","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fantagon%2FTCHunt-ng/lists"}