Exploring the Use of Steganography and Steganalysis in Forensic Investigations for Analysing Digital Evidence

Image steganography and steganalysis have gained significant popularity in recent years. The military, medical, e-governmental and social media fields are some places where image steganography and steganalysis are utilized. To answer the growing demands, digital forensic investigators (DFI) are interested in analysing the implications of image steganography and steganalysis domains. Nevertheless, these professionals have limited qualitative resources dedicated to a systematic analysis of techniques, tools and metrics used in these domains. This research concentrates on 3 parts. First, an extensive literature review of the existing papers for Artificial Intelligence (AI), statistical and signature steganalysis techniques is performed. The study suggests that AI-driven steganalysis techniques are not strictly better at detecting image steganography, compared to the rest. Second, some popular, non-paid steganography (F5, Steghide and Outguess) and steganalysis (Aletheia, StegExpose) tools are utilized on a JPEG dataset. The detection accuracies are compared to answer why despite having a lower accuracy, Aletheia is more appropriate for DFI than StegExpose. Finally, features such as size, colour, mean squared error (MSE) and peak signal-to-noise ratio (PSNR) between stego (with different sizes of embedded secret text) and cover JPEG images from the dataset are examined. It is found that none of the chosen features produces a direct indication regarding the possible existence of hidden messages inside JPEG images. Overall, the current research performs a novel qualitative approach, performing a literature review as well as experimentation. Based on that, the results and conclusions could help professionals to tackle and analyse image steganography and steganalysis more systematically, to obtain more insightful results.