Computer Forensics Steganography

Question :

Define steganography, why an attacker or criminal might use it, and what tools can be used by the investigator to determine if steganography has been used?

Discuss the role that volatility plays in a digital forensics investigation and how you would approach recovering the most volatile data.

Answer :

Steganography can be defined as a practice of concealing a message, video, file, or image in other files, messages, videos, or images. The information is encoded in other similar looking innocent files such as image files, video files, etc.

It is used by attackers or criminals to communicate with their partners about critical information about their plans. It also helps them to identify all networks that are under surveillance of police or intelligence agencies. They can use steganography to communicate secretly with their partners (Tao et al., 2018). They can encode the message in a simple image and hence the filtering system cannot detect the message because the system will consider it an image file. 

There are various tools that could be used to detect steganography such as Steganabara, Stegbeak, StegCraker, etc. 

Volatile data can be defined as the data that is stored in volatile memory such as RAM. Volatile data should be considered to be a part of the digital forensic process. It helps in providing important as well as crucial information that could not be acquired by the traditional forensic process. Following traditional forensic processes could not help in identifying and analyzing the current state of the system, open ports, username as well as password, running processes, recently established connection, anti-forensic activities, traces of malware, unencrypted data as well as keys (Memaripour et al., 2020). But volatility would certainly help in identifying and analyzing such information that is crucial to conduct a forensic investigation.

Recovering the most volatile data

Mobile devices such as smartphones contain information to help in collecting evidence or to allow more informed decisions to be made. From the internal memory of the mobile devices, such information can be retrieved. There are several tools that could also be used to recover the most volatile data.

References 

Tao, J., Li, S., Zhang, X., & Wang, Z. (2018). Towards robust image steganography. IEEE Transactions on Circuits and Systems for Video Technology, 29(2), 594-600.