Patent ID: 7564969

Claim:
A computerized method for determining whether a data stream is in a cyphertext format, wherein said data stream is characterized by a plurality of data bytes, each having an associated byte value, said method comprising: performing a statistical analysis of the associated data stream's byte values to compute a statistical result having a resultant value indicative of a level of uniformity for a frequency distribution of the byte values in the data stream; comparing the resultant value to a threshold; determining whether a header portion of the file corresponds to a known file type based on the comparison; and controlling an output device to display an output corresponding to an existence of cyphertext based on the resultant value indicating non-uniformity of the frequency distribution and the determination of the header portion, wherein the output includes a tabulation of a total number of files searched, a total number of files deemed to be too small to search, and a total number of each predetermined format encountered.