Truxton file get entropy

This retrieves the entropy of the contents of the file. It corresponds to the [RawEntropy] column of the [File] table.

Syntax

double truxton_file_get_entropy( uint64_t file_handle );

Parameters

file_handle

The handle created by the truxton_file_open_id or truxton_file_open_md5 call.

Return value

The entropy of the file's contents.

Sample

void print_it( uint64_t truxton )
{
   uint64_t file = truxton_file_open_md5( truxton, "9ec8fb6095c35eff2b236863b7caaf10" );

   if ( file != 0 )
   {
      return;
   }

   double entropy = truxton_file_get_entropy( file );

   if ( entropy > 7.97 )
   {
      printf( "File is likely encrypted.\n" );
   }

   truxton_file_free( file );
}

Remarks

Entropy, aka Shannon's entropy, is a floating point number between zero and eight. It is the number of bits required to represent the information in the file. Lower values means there's less information, high values means there's lots of information in the data. A file containing a million 0xFF characters will have an entropy of zero, no information, because there's nothing but a single value represented in the file a million times. Text is usually in the 5.6 range. Compressed files will about 7.8 and encrypted files will be 7.99 or 8.