I am working on a anti-ransomware project. It simply monitors the filesystem, and watches for files being created, and deleted. (also monitors for known ransomware file extensions.)

Basic Operation: If (File X in Directory Y is created), and soon-after (File Z in Directory Y is deleted.) Scan File X and try to determine if it is an encrypted file.

I am stuck because I have no idea how to determine if a file is encrypted or not. I have read through quite a few threads on SO, but I've still turned up empty.

My question is basically: What methods can be used to determine if a file is encrypted?