Steganography on Criminal Suspect Computers Project

Research Areas: Prevention, Detection and Response,

Principal Investigator: James Goldman

The installation and use of steganographic applications leave traces of these activities on the host system. Using disk images from seized computers, researchers use host system artifact detection software to determine if there is evidence of steganography software installed on these seized hard drives. The results are then be analyzed to determine the relative percentage of hard drives in the sample which showed evidence of installation and/or use of steganographic embedding applications, and what the applications of choice were in relation to the crimes committed with the computers in question. Results of research to date are being published.

Keywords: steganography, security, crime scene analysis