I've heard of tools that could be used to graph entropy of a file. Is there a graphical Linux program that I could use for this job that would let me conveniently explore which blocks of a file have certain entropy patterns that could suggest compressed or encrypted data?
From the manual page of Radare2:
#[hash] Calculates the sha1, sha256, sha384, sha512, par, xor, xorpair, hamdist, mod255, crc16, crc32, md4, md5, entropy of the current block from the selected seek
So, using this command is as follow:
$ radare2 /bin/ls [0x00404890]> #entropy 5.338618
Get these modules and run it on your file.
Detect It Easy can do it:
There is version for Linux.
ent: https://www.fourmilab.ch/random/ to run statistical tests checking for randomness.
$ cat 1-gb-file.img | ent Entropy = 7.999998 bits per byte. Optimum compression would reduce the size of this 100000000 byte file by 0 percent. Chi square distribution for 100000000 samples is 249.38, and randomly would exceed this value 58.75 percent of the times. Arithmetic mean value of data bytes is 127.4928 (127.5 = random). Monte Carlo value for Pi is 3.141514686 (error 0.00 percent). Serial correlation coefficient is -0.000094 (totally uncorrelated = 0.0).