Using Stegdetect on Windows Drive

[joetekno]

To use Stegdetect on a mounted Windows Drive do the following:

NOTE: I always use a physical write blocker before conducting any forensic investigation.

Mount the drive (example of a 20 GB hard drive)
Start... Places... [20.0 GB media]

Verify the device has been mounted read only
Open a terminal windows, type "mount", device should be read only
(example output /dev/sda1 on /media/sda1 type ntfs (ro, noexec, nosuid...)

Create a symbolic link to the directory you are analyzing on the hard drive if it contains any spaces (ie /media/sda1/Documents and Settings/Student/Pictures)

In your terminal window...
type: cd Desktop <press enter key>
type: ln -s /media/sda1/Documents\ and\ Settings/Student/Pictures steg

Open the Caine Interface
"Start"... CAINE... Caine Interface
Click Create Report
Select Analysis
Click Stegdetect
Click input directory
Click file system...home...caine...Desktop...steg
Click OK
Click Run Steg detect

[Giancarlo]

Thank you so much... Very detailed!

[putosusio]

Joe:

Is this assuming you know stenography was used or simply run to the tool to see if it was used? I've read a little about stenography and from what I remember the tool that was used to do the stenography has to be used to "decipher" the file. Is that not the case?

[Sponsored content]