Truehunter is a forensic tool designed to detect encrypted containers, specifically targeting Truecrypt and Veracrypt containers, though it can identify any encrypted file with headers not in its database. The tool operates using a fast and memory-efficient approach without external dependencies, making it highly portable. It performs three primary checks during analysis: testing the first 8 bytes of files against its internal database, verifying that file size modulo 64 equals zero (indicating block cipher usage), and calculating file entropy to assess randomness. Truehunter creates and maintains a headers database file during first use, which stores the first 8 bytes of every scanned file along with extension and date information. This database can be updated after each scan to improve detection accuracy. The tool offers two scanning modes: Fast Scan searches for files with size divisible by 64, unknown headers, and appearance frequency below a configurable threshold (default 3). Default Scan performs the fast scan operations plus entropy calculation to reduce false positive results. Truehunter is included in the BlackArch forensic tools collection and supports Python versions 2.7 through 3.7 without requiring additional libraries for installation.