FINDKEY(1)

NAME
findkey - find high-entropy data

SYNOPSIS
findkey [-cdlmx] [-b bias] [-w window] [-t threshold] file...

DESCRIPTION
findkey moves a fixed-size window over the named files (stdin by default) and reports window positions containing a large number of different symbols. This approach, described by Shamir and van Someren, simplifies Shannon's entropy formula and allows for faster searching. By default, overlapping regions of window bytes with high-entropy content are reported as one large region:
file start [content] length Fields are tab separated. By default no content is shown. In order to display the content of potential keys, specify the -x option (show content). In order to report potential keys individually, specify the -d option (detail mode). Options:

-c  Calibration mode. Report each high-entropy region of window bytes as: file start threshold bias [content]. This is useful for deriving good threshold and bias values from real data. Use of this option implies -d.

-d  Detail mode. Report each high-entropy region of window bytes as: file start [content]. This option increases the amount of output considerably. Combine this option with with -x to display the content of individual keys.

-b bias (default: 31)
    Exclude data that is too monotonic. findkey counts how often successive byte values increase or decrease. The number of increments and decrements in a window must not differ by more than bias. For 64-byte windows, 22 is a good bias value.

-l  Report only the names of files containing high-entropy regions.

-m (default)
    Merge mode. Report multiple overlapping high-entropy windows as one region, using the format: file start [content] length. Use of this option can reduce the amount of output considerably.

-t threshold (default: 95)
    Search for windows with at least threshold different symbols. For 64-byte windows, 52 is a good threshold value.

-w window (default: 128)
    Search for high-entropy regions of at least window bytes. Use of -w also requires use of the -b and -t options.

-x  Display high-entropy content in hexadecimal form.

HISTORY
This findkey command was written for the coroner's toolkit.

LICENSE
This software is distributed under the IBM Public License.

SEE ALSO
A. Shamir and N. van Someren, Playing Hide and Seek With Stored Keys, 1998.
http://www.ncipher.com/products/files/papers/anguilla/keyhide2.pdf.

C.E. Shannon, A mathematical theory of communication. Bell System Technical Journal 27 (1948) 379-423, 632-656.
http://cm.bell-labs.com/cm/ms/what/shannonday/shannon1948.ps.gz

AUTHOR(S)
Wietse Venema
IBM T.J. Watson Research
P.O. Box 704
Yorktown Heights, NY 10598, USA