PILLAR 1: CRYPTOGRAPHIC HEADER CARVERBYTE OFFSET & ENTROPY PROFILER
Encrypted File Pattern & Header Damage Analyzer
Select Sample:
Header Damage Size
512 Bytes
Overwritten from offset 0x00
Encryption Mode
BLOCK_CIPHER
Cipher: ChaCha20 + Curve25519
Shannon Entropy
7.988 / 8.00
High-entropy cipher randomness
Canary Footer Marker
LOCKBIT_META_V3_TAG
✓ RSA Metadata Sealed
SHANNON ENTROPY HEATMAP (64-BLOCK SECTOR PROFILE)
Differentiates encrypted blocks (> 7.80, red) from unencrypted structured plaintext (< 6.00, green/cyan)
■ Encrypted (>7.8)■ Plaintext Body (<6.0)
7.986
7.930
7.942
7.959
7.925
7.987
7.958
7.987
7.938
7.933
7.986
7.967
7.931
7.953
7.953
7.928
7.984
7.944
7.965
7.970
7.961
7.968
7.970
7.946
7.975
7.924
7.959
7.987
7.942
7.925
7.953
7.986
7.924
7.981
7.968
7.945
7.990
7.947
7.943
7.973
7.924
7.979
7.958
7.920
7.945
7.957
7.982
7.968
7.978
7.949
7.960
7.961
7.923
7.938
7.958
7.990
7.946
7.945
7.966
7.942
7.926
7.926
7.987
7.942
HEADER BYTE OVERWRITE INSPECTION (Patient_Records_2026.mdf.lockbit)
Side-by-side diff comparing known clean header template against encrypted artifact
| Offset | Clean Plaintext Template | Encrypted Artifact Bytes | Damage Assessment |
|---|---|---|---|
| 0x00000000 | 4D 53 53 51 4C 5F 44 42 30 31 00 00 04 00 00 00 | 9A 4F C2 81 33 B8 19 0E 77 F1 AA 20 49 BD 8C 11 | OVERWRITTEN / ENCRYPTED |
| 0x00000010 | 00 10 00 00 00 20 00 00 40 00 00 00 80 00 00 00 | 14 E8 7B C9 03 FA 44 91 22 66 CD 10 99 FE 31 0A | OVERWRITTEN / ENCRYPTED |
| 0x00000020 | 50 61 74 69 65 6E 74 53 63 68 65 6D 61 5F 76 33 | 88 C1 04 99 DA 30 1F 7C A1 B2 C3 04 55 99 82 FC | OVERWRITTEN / ENCRYPTED |
| 0x00000030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | EE 34 11 90 AB CD EF 01 23 45 67 89 0A BC DE F0 | OVERWRITTEN / ENCRYPTED |
| 0x00000200 | 54 41 42 4C 45 5F 53 50 41 43 45 5F 44 41 54 41 | 54 41 42 4C 45 5F 53 53 41 43 45 5F 44 41 54 41 | INTACT DATA PAGE |
| 0x00000210 | 30 30 30 31 2E 64 61 74 00 00 00 00 00 00 00 00 | 30 30 30 31 2E 64 61 74 00 00 00 00 00 00 00 00 | INTACT DATA PAGE |