Tools Included in the Suite

Stego Hunter is designed to quickly, accurately and easily detect steganography programs as a first look in the investigation process. Often we are asked "how do you know if steganography exists?" With Stego Hunter, results are easily reported back to the investigator of any installed or even previously installed applications.  We even take this a step further and flag the suspected carrier types you should then look for to further your investigation process. We have the capability to scan  forensic images of other popular forensic tools such as EnCase, FTK, dd, raw, ISO and safeback images.

Stego Watch is our state-of-the-art anomoly based steganography detection tool.  Once suspected carrier files are found; Stego Watch can automatically scan the entire file system and results are brought back into a easy to read interface with suspected files flagged.  Files flagged are detected with a blind detection technique looking for artifacts within those scanned media files and then displayed with a threat association and notification of any artifacts found. No prior knowledge of steganography programs is necessary.

Stego Analyst is a full featured imaging and analysis tool allowing investigators to search for visual clues that steganography has in fact been utilized in both image and audio files. Provided is a file viewing panel which displays the individual file image or audio wave and the file attributes including image details, DCT coefficients, color pairs and more. In order to allow investigators to look for further clues that steganography is in use, we have included filter options that transform the images into one of three different presentations: Intesity, Saturation or Hue. Other filter options display only selected Least Significant Bits (LSBs) of specific colors.  Since many steganographic techniques use LSB's for data hiding, viewing the LSBs of an image can sometimes reveal indicators of steganography.

Stego Break is a built in utility designed to obtain the pass phrase that has been used on a file found to contain steganography. Included with the purchase of the tool are popular password dictionaries in order to execute a dictionary attack.  Investigators also have the ability to bring in other dictionaries or if they have reveled the password through suspect questioning, they can run the password against the detected image or audio files.  If you are able to extract a file that is encrypted, we encourage you to contact a specialist with expertise in encryption.