is there a way to check that the file data is encrypted or not?

Question

I want to check if file is encrypted or not , is there any better way to check if we can detect encrypted or not.

• I have used shannon entropy to check files entropy, by doing this we can find the entropies of file which will lead to conclusion that data is either encrypted , compressed or have random data because if entropy of file is high , it can state these three conditions
• But, it can not distinguish between compressed and encrypted file as high entropy can lead to any of these conditons

How can we detect that file is encrypted or not?

Answer 1

Theoretically, you can't tell the difference between random data, encrypted data, and data that has been maximally compressed.

In real life, though, compressed and encrypted data are encoded in file formats with headers and other low-entropy regions that you can use to recognize them.

A pretty good implementation would be to look for a whole bunch of tags that you know, and then use a rule of thumb:

• Small bit of low-entropy stuff at the beginning => encrypted, while
• Long bit of low entropy stuff at the beginning (like jpeg), or low entropy stuff at the end (like zip), or many little low entropy bits in between (like audio/video) => compressed.

Also, the overall entropy of compressed data, if you measure it with bigrams or trigrams, will not be as high as encrypted data, because compression is never perfect.