摘要
TrueCrypt作为目前较为流行的免费开源加密软件之一,在不同平台上得到了广泛的应用。取证过程中经常要对磁盘中的加密文件检测以便进行进一步的解密分析,但由于TrueCrypt加密容器在解密之前不具备任何的签名、结构等特征,因此TrueCrypt加密容器的检测成为了取证过程中的一个难点。目前,还没有精确的TrueCrypt加密容器的检测方法,现有的检测技术主要是通过签名排除结合文件大小信息进行检测。文章在现有检测技术的基础上结合了卡方检验以及信息熵的理论方法,提出了一种TrueCrypt加密容器快速检测技术。该技术不仅能够快速的检测加密容器,而且和现有的检测方法相比检测精确度更高。
TrueCrypt as one of the popular free open source encryption software has been widely applied on different platforms. Forensics process often to detected encrypted ifle for further decrypt and analysis, but TrueCrypt container has no signature and structure, so it is a dififcult to detect TrueCrypt container. In view of the TrueCrypt container ifle, there is no accurate detection method, the available technology is signature rule out combined ifle size limit to detect TrueCrypt container. In this paper, on the basis of the existing detection technology, combined with chi-square test and information entropy theory, we came up with a fast TrueCrypt container detection technology. This method not only can quickly detect TrueCrypt container, but higher precision compared with the existing detection methods.
出处
《信息网络安全》
2014年第9期220-222,共3页
Netinfo Security
关键词
文件签名
扇区大小
卡方检验
显著水平
信息熵
ifle signature
sector size
chi-square
signiifcance level
information entropy
