What is the best way to detect Steganography in a large-scale digital forensic investigation?

All answers to this question.

Steganalysis is incredibly difficult at scale. You should start by looking for "signature" changes in the metadata or unusual file sizes for the resolution of the image. For automated analysis, tools like StegExpose or StegDetect use statistical methods to look for Least Significant Bit (LSB) anomalies. A Chi-square test is particularly effective for detecting LSB steganography because it looks for a "flattening" of the color frequency that occurs when data is hidden. If you find a cluster of suspicious files, use a tool like "StegSolve" to manually inspect the different bit planes. Usually, the data is hidden in the very lowest bit layers.

   Answered 2024-05-22 by Dorothy Lewis

Have you tried comparing the suspicious files against a "clean" set of the same images? If you can find the original stock photos online, a simple bit-by-bit comparison will reveal the hidden payload immediately.

   Answered 2024-05-26 by Richard Harris

• Richard, that is our first step if we can identify the source! However, in this case, the suspect took the photos themselves. We’ve had to rely on looking for "statistical noise" in the high-frequency areas of the images. We actually found that the suspect was using a specific mobile app for the encryption, which left a unique header in the padding of the JPEG files. Once we found that header, we could filter the entire drive for similar files in minutes

     Commented 2024-05-29 by Michael Scott

Also look for "hidden" streams in NTFS (Alternate Data Streams). Sometimes people think they are being clever with images when they are just using basic OS features.

   Answered 2024-06-01 by Elizabeth Young

• Good point, Elizabeth. ADS is a classic trick. It’s always worth checking for those extra streams before diving into deep statistical steganalysis of the pixels

     Commented 2024-06-03 by Lisa Anderson