TCHunt

Data encryption is among the safest ways to keep sensitive protected against prying eyes and software such as TrueCrypt is capable of encrypting entire volumes and hide them.

TCHunt is a nifty little application that can reveal the presence of such drives on a hard disk. It does not require installation and runs in Windows Command Prompt.

As such, some users may feel a bit reticent about working with it, although operating it is far from being a difficult task.

Launching the application in the console shows the full list of options and parameters, which is not too long.

The purpose of TCHunt is to locate volumes that have been encrypted and hidden with software crafted for such activity. It can determine if such partitions exist on the system but it cannot be used to decrypt them.

One thing you have to keep in mind is that TCHunt does not make any difference between a protected partition and a standard one.

The application ignores completely the file extensions and relies entirely on a set of four attributes that are generally mark the presence of hidden data.

However, this does not eliminate the possibility to false positives and this is the intended bahavior of the program because false flags can be dismissed by the user. Also, according to the developer, the source of a false positive can represent other forms of encryption as well as files with random data, which cannot be distinguished from encrypted one.

TCHunt has been designed as a way to convince users that keeping data encrypted and hidden does not make it completely undetectable. It is easy to use and the chance of false negatives is quite low, although this can happen under certain circumstances.