Steganography
Definition
Concealing one file inside another in a way that hides the existence of the hidden file. LSB image manipulation, JPEG DCT coefficient manipulation, and audio LSB are the standard channels. StegHide and OutGuess are the canonical encoders; StegExpose and StegoVeritas are the standard detectors.
- Greek origin
- The word comes from the Greek for covered writing
- Key detection tools
- StegExpose, StegoVeritas, and statistical chi-square analysis
- Key encoding tools
- StegHide, OutGuess, and F5
Common questions
What is steganography and how does it differ from encryption?+
Steganography hides the existence of a message by concealing it inside another file, like an image or audio. Encryption scrambles the message content but makes it obvious something secret is there. Steganography keeps your hidden data invisible to the casual observer.
What are the most common methods used to hide data?+
The standard channels are LSB (least significant bit) image manipulation, JPEG DCT coefficient manipulation, and audio LSB. LSB works by encoding payload bits into the lowest-value bits of pixels or audio samples, which humans cannot perceive. Tools like StegHide and OutGuess are the canonical encoders.
How do forensic investigators detect hidden data?+
Detectors like StegExpose and StegoVeritas can identify steganographic modifications. Forensic methods also use statistical analysis, like chi-square tests against LSB planes, and look for noise signatures that steganography introduces into images.
Related terms
- VeraCrypt Hidden Volume
- A second, encrypted volume nested inside the free space of a primary VeraCrypt volume. Either password unlocks one of the two volumes;...
- Anti-Forensics
- Any deliberate technique used to hinder, mislead, or defeat forensic examination. The term was coined in the late 1990s by US incident...
- BitLocker
- Microsoft's full-volume encryption on Windows. Volume Master Key wrapped under TPM, password, recovery key (48 digits), or AD/MBAM/Intune escrow. Hashcat mode -m...
- C2PA (Coalition for Content Provenance and Authenticity)
- An open technical standard that embeds cryptographically signed provenance assertions into media files at the point of capture or editing. A C2PA...
- Camera Noise Model
- A mathematical description of a sensor's noise as a function of signal level, combining signal-dependent shot noise and signal-independent readout noise. The...
- Carrier (Cover Object)
- The original file, image, audio recording, or video clip used to conceal the hidden message. The modified version containing the hidden data...
- CFA (Colour Filter Array)
- The mosaic of colour filters placed over a sensor so that each photosite captures one colour channel. The Bayer pattern (RGGB arrangement)...
- CFA Phase
- The spatial offset of the CFA mosaic pattern in an image. Pasting a region from a different image or after a non-CFA-aligned...
- Charred Document
- Paper that has been burned to the carbonised stage but not fully reduced to ash; the cellulose has pyrolysed and the sheet...
- Cold-Boot Attack
- An attack on full-disk encryption that exploits the fact that DRAM contents fade gradually after power-off. With the chips cooled to roughly...
- Covert Channel
- Any communication path that was not intended by the system designer and that bypasses access-control or monitoring policies. Network covert channels are...
- DCT Coefficient Manipulation
- A transform-domain technique that embeds data in the discrete cosine transform coefficients of a JPEG block, operating within the compressed representation rather...
Explained in these topics
- Anti-Forensic Techniques and Investigator Counter-MethodsConcealing one file inside another in a way that hides the existence of the hidden file. LSB image manipulation, JPEG DCT coefficient manipulation, and audio L...
- Data Recovery and File Carving: Deleted, Hidden, EncryptedHiding data inside other data, typically by encoding payload bits into the least significant bits of pixels or audio samples. Tools: StegHide, OutGuess, F5. De...
- Indentations, Secret Writings and Charred DocumentsDigital descendant of secret writing: hiding a message inside another file (image LSB, audio, video) so that the existence of the message is concealed, not jus...
- Media Authentication FundamentalsThe practice of embedding hidden data within a carrier media file in a way that is imperceptible to a casual observer. In authentication, steganalysis determin...
- Noise and CFA Inconsistency DetectionThe practice of hiding data within a digital image by making imperceptible modifications to pixel values. In the forensics context, steganographic modification...
- Steganography Methods in Images, Audio, and VideoThe practice of hiding a secret message inside a carrier file in such a way that the presence of the hidden data is not apparent to an observer. The word comes...