Possible encryption detected (high entropy)

[eniocc]

Hello everybody. I'm processing a HD using IPED and I came across the following error message "1. Possible encryption detected (High entropy (7.85)) (Sector offset: 0) ...". In IPED 21k multimedia files appeared while in FTK Imager many other files appeared. Am I doing something wrong? Thanks in advance.

[wladimirleite]

Hello @eniocc!

What is the kind of partition FTK Imager detected?
What IPED version are you using?

In some cases TSK (used by IPED) fails to identify the file system, but FTK Imager does it successfully.
In such cases, as a workaround, it is possible to export the content to an AD1 and then use that AD1 as IPED's input.

[wladimirleite]

NTFS should be handled properly by TSK...
You are using Windows, right?
Try running tsk_loaddb.exe directly on your image later.
Which format/extension are you using (E01, DD)?

[eniocc]

Yes, I'm using and E01. Trying tsk_loaddb.exe now.

[eniocc]

NTFS should be handled properly by TSK... You are using Windows, right? Try running tsk_loaddb.exe directly on your image later. Which format/extension are you using (E01, DD)?

The output was: "Error: Cannot determine file system type (Sector offset: 34, Partition Type: Microsoft reserved partition). Database stored at: .."

[wladimirleite]

The output was: "Error: Cannot determine file system type (Sector offset: 34, Partition Type: Microsoft reserved partition). Database stored at: .."

This is usually a small partition that does not store user data, so this error could be ignored.

[eniocc]

The output was: "Error: Cannot determine file system type (Sector offset: 34, Partition Type: Microsoft reserved partition). Database stored at: .."

This is usually a small partition that does not store user data, so this error could be ignored.

You are right, but the process has stopped for an unknown reason.
After running tsk_loaddb.exe directly on the image and running the IPED process again with the same command and parameters, the error is gone and it is processing perfectly as usual.
Thanks a lot for the support.