I downloaded the chart and, much to my chagrin, discovered the following at the bottom of the chart: “Return On Investment (Determine when to stop this process. Typically, after enough evidence is obtained for prosecution, the value of additional forensic analysis diminishes.)”
On the one hand, this is understandable because investigators and forensic examiners typically have a large backlog of cases to work on. And, as storage densities have continued to increase, there is an increasing amount of information to process for each case. Coupled with pressure from management and prosecutors to push out as many cases as possible and do it as quickly as possible, it would seem to make sense to take a minimalist approach and spend only as much time as is necessary to find just enough evidence for prosecution or to obtain a plead out and then stop the examination. But does this approach really make sense?
Let’s consider a fictional case involving the use of digital steganography for distribution of child pornography.
After the suspect’s computer and storage media has been seized and imaged, the forensic examiner finds some number of child pornography images in the clear. The images are checked against NCMEC’s CVIP database as the case agent learns the images are part of a collection that has been circulating around the Internet for quite some time. The investigator also learns that all of the children in the images have been identified and rescued from further exploitation and decides to stop the examination at that point and present the evidence to the prosecutor. The suspect pleads nolo contendere and accepts a plea agreement to avoid his family enduring the embarrassment of a public trial. The prosecutor congratulates the investigator and forensic examiner for another job well done in taking another sexual predator off the streets. The case is closed and the investigator and forensic examiner move on to the next case. Everything is hunky-dory, right?
Not so fast. What if the suspect had obtained the illicit images embedded within innocuous looking images such as a toy train collection for sale on eBay or some other set of completely innocuous looking images used as the carrier files? The suspect would have had to use the steganography application that was used to embed the images in order to extract them. Now suppose the suspect had extracted only a few images from the carrier files. There would be other images that had not yet been extracted. Some of these images may contain pictures of children not yet identified in the CVIP database and are, therefore, still be victimized.In this fictional case, an artifact of the steganography application used by the suspect to extract the illicit images from the carrier files may have been discovered if the examiner had continued the examination instead of stopping after finding images in the clear. The artifact may have been a file associated with the steganography application or a Windows Registry artifact. Discovering the suspect had used steganography may have let to the discovery of the other images still embedded in the carrier files. That may have led to the identification and rescue of previously unidentified child victims.
Far-fetched you say? Perhaps, but one can’t help but wonder how much digital evidence is going undetected because it was hidden with a steganography application but the examiner didn’t conduct steganalysis as a routine aspect of their examination because of the belief the suspect was too stupid, too lazy, or both, to use steganography.
Also, it must be mentioned that stopping an examination after just enough evidence is obtained for prosecution, or a plead out, may result in overlooking evidence that may be more valuable to the investigation and subsequent prosecution than any evidence that may have been easily found in the clear.
While it is true that a typical suspect is not going to think of the word “steganography,” it is equally true, and should be reasonably presumed, the suspect will think of something like “hiding information” or “information hiding.” If you want a real eye opener as to the extent of the threat from criminal use of steganography, simply do a Google search on “information hiding” and Google will return over 8,000,000 hits! Many of the links will lead to web sites where steganography applications can be downloaded as freeware or shareware or a license can be purchased for a small amount.
Given the growing use of anti-forensic tools, including digital steganography, it seems examiners need more comprehensive forensic tools that provide the capability to perform steganalysis and to search for other forensic tools. Thus far, the major forensic tool vendors have not seemed terribly interested in capabilities for detecting anti-forensic tools. That, in and of itself, seems very odd because one would think the first thing an examiner would want to do is determine if the suspect had used any tools that would taint any evidence their forensic tool(s) of choice would find.
Until such time as the major forensic tool vendors decide to incorporate anti-forensic tool detection capability in their tools, examiners are left to find other tools to search for the presence or use of digital steganography applications or other anti-forensic tools.
In summary, I would suggest revising the chart to avoid conveying the message, whether real or implied, that a minimalist approach to digital forensic analysis is sufficient. I would also suggest adding a bullet to the Search Leads table (see graphic) that reads "Search media for presence of digital steganography applications and other anti-forensic tools.”
Steganalysis must become part of the digital forensic analysis methodology or potentially crucial evidence will continue going undetected.
