drop a raw disk image · compute shannon entropy for every 512-byte sector · render a full disk entropy heatmap · instantly visualize where encrypted compressed or random data lives vs normal filesystem content · locate hidden encrypted volumes · runs locally
disk image
drop disk image (+ optional mft csv)
large files processed in 64MB chunks · blue=empty · red=encrypted
drop raw disk image · .dd .img .raw · optional mft csv overlay