There are a lot of presumptions in this method, but an other way to approach this is eliminate all known and signature matched files at cluster level.
What remains most likely will contain your encrypted area.
↧