antagon / TCHunt-ng

Reveal encrypted files stored on a filesystem.
GNU General Public License v3.0
51 stars 8 forks source link

Decode base64 and hexadecimal data #2

Open antagon opened 7 years ago

antagon commented 7 years ago

If content of a file is base64 encoded or hexadecimal data, run the tests against the decoded content. This defeats openssl's (and possibly others) armoring feature that otherwise protects files from being discovered.