Abstract
Ensuring reliable detection of encrypted data is increasingly important for protecting smart grid infrastructures and supporting mobile forensic investigations. This study investigates statistical and non-statistical approaches for encrypted data detection, including the Kolmogorov–Smirnov test, autocorrelation analysis, compression testing, file signature search, entropy estimation, and file system recognition. The main contribution of this work is a novel hybrid expert system that combines multiple detection methods with a knowledge-based inference engine to provide intelligent and explainable decision-making. Experimental results demonstrate that the proposed system achieves over 90% accuracy in identifying encrypted data under diverse conditions, including scenarios involving empty blocks that affect statistical distributions. Compared with conventional entropy-based and single-test approaches, the proposed framework provides improved accuracy, scalability, transparency, and adaptability.