Difference between revisions of "Truxton file get entropy"
(Created page with "This retrieves the entropy of the contents of the file. It corresponds to the <code>RawEntropy</code> column of the <code>File</code> table. =Syntax= <syntaxhighlight lang="C...") |
|||
| Line 1: | Line 1: | ||
This retrieves the entropy of the contents of the file. | This retrieves the entropy of the contents of the file. | ||
| − | It corresponds to the <code>RawEntropy</code> column of the <code>File</code> table. | + | It corresponds to the <code>RawEntropy</code> column of the <code>[[File Table | File]]</code> table. |
=Syntax= | =Syntax= | ||
Revision as of 06:32, 10 June 2020
This retrieves the entropy of the contents of the file.
It corresponds to the RawEntropy column of the File table.
Syntax
double truxton_file_get_entropy( uint64_t file_handle );
Parameters
file_handle
The handle created by the truxton_file_open_id or truxton_file_open_md5 call.
Return value
The entropy of the file's contents.
Sample
int print_it(uint64_t truxton)
{
uint64_t file = truxton_file_open_md5(truxton, "9ec8fb6095c35eff2b236863b7caaf10");
if ( file != 0 )
{
return(0);
}
double entropy = truxton_file_get_entropy( file );
if ( entropy > 7.97 )
{
printf( "File is likely encrypted.\n" );
}
}
Remarks
Entropy, aka Shannon's entropy, is a floating point number between zero and eight. It is the number of bits required to represent the information in the file. Lower values means there's less information, high values means there's lots of information in the data. A file containing a million 0xFF characters will have an entropy of zero, no information, because there's nothing but a single value represented in the file a million times. Text is usually in the 5.6 range. Compressed files will about 7.8 and encrypted files will be 7.99 or 8.
