IBM ICE (Innovation Centre for Education)

Welcome to:
Steganalysis - Data Hiding/Recovery

© Copyright IBM Corporation 2016 9.1

Unit objectives IBM ICE (Innovation Centre for Education)
IBM Power Systems

After completing this unit, you should be able to

• Understand Steganography
• Understand Steganalysis, its hierarchy, types and functions
• Learn the Tools for Steganography
• Understand Data Recovery Techniques

© Copyright IBM Corporation 2016

Introduction to Steganography IBM ICE (Innovation Centre for Education)
IBM Power Systems

1. The purpose of steganography is covert communication to hide a message

from a third party.
2. This differs from cryptography,
3. Although steganography is separate and distinct from cryptography, we can
categorize steganography as a form of cryptography since hidden
communication is a form of secret writing
© Copyright IBM Corporation 2016
Steganography Background IBM ICE (Innovation Centre for Education)
IBM Power Systems

• Steganography has become increasingly popular in the past years, due to the explosion of
the internet and multi-media use in general.
• Most of the attention has been drawn now because of the malicious use of the technique.
• It has become a threat not only to individuals and businesses, but to government agencies
across the world.

• Steganalysis is the detection of embedded data.

– There are so many methods to embed the information, it is hard to develop programs to distinguish
between the different types.

© Copyright IBM Corporation 2016

Steganography Functions IBM ICE (Innovation Centre for Education)
IBM Power Systems

• Not only are there several programs that hide information, there are several different
methods for doing so.
• There are three basic ways:
– injection,
– substitution, and
– generation.

Steganography in Images
• Steganography in images is mainly classified into:
– >Least significant bit (LSB) insertion method.
– >Masking and filtering.
– >Algorithms and transformation.
• There are mainly three transformation techniques:
1. Fast Fourier transformation technique (FFT)
2. Discrete cosine transformation technique (DCT).
3. Discrete Wavelet transformation technique (DWT).

© Copyright IBM Corporation 2016

Robustness and Cryptography IBM ICE (Innovation Centre for Education)
IBM Power Systems

• Steganography tools aim to ensure robustness against modern forensic methods, such as
statistical steganalysis.

• Such robustness may be achieved by a balanced mix of:

I. a stream-based cryptography process;
II. a data whitening process;
III. an encoding process.

© Copyright IBM Corporation 2016

Steganalysis IBM ICE (Innovation Centre for Education)
IBM Power Systems

• Steganalysis is simply the detection of steganography by a third party.

• A relatively new field, since the new technology behind steganography is just becoming
popular.

• There are two main types of steganalysis:

– visual analysis
– statistical (algorithmic) analysis.

© Copyright IBM Corporation 2016

Steganography Hierarchy IBM ICE (Innovation Centre for Education)
IBM Power Systems

© Copyright IBM Corporation 2016

Image Steganalysis IBM ICE (Innovation Centre for Education)
IBM Power Systems

• Algorithms for image steganalysis are primarily of two types:

– Specific and
– Generic.

• Palette Image Steganalysis

• Raw Image Steganalysis
• JPEG Image Steganalysis
• Generic Image Steganalysis Algorithms

© Copyright IBM Corporation 2016

Digital Image and Audio - 1 IBM ICE (Innovation Centre for Education)
IBM Power Systems

Figure1: RGB color Cube

Figure2:
This color selection dialogue box shows the red,
green, and blue (RGB) levels of this selected color.

© Copyright IBM Corporation 2016

Digital Image and Audio - 2 IBM ICE (Innovation Centre for Education)
IBM Power Systems

Figure3: Simple Pulse Code Modulation

Figure4: Some common digital formats. This
color selection dialogue box shows the red,
green, and blue (RGB) levels of this selected
color.

© Copyright IBM Corporation 2016

Audio Steganalysis IBM ICE (Innovation Centre for Education)
IBM Power Systems

• Rapid advancement of the Voice over Internet Protocol (VoIP) and various Peer-to-Peer
(P2P) audio services offer numerous opportunities for covert communication.
• Minor alteration in the binary sequence of audio samples with existing steganography tools
can easily make covert communication, a reality.

• Audio signals have a characteristic redundancy and unpredictable nature

• Audio signals are ideal to be used as a cover for covert communications to hide secret
messages.

• Audio Steganography Algorithms

© Copyright IBM Corporation 2016

Video Steganalysis IBM ICE (Innovation Centre for Education)
IBM Power Systems

© Copyright IBM Corporation 2016

Tools for Steganography – Overview 1 IBM ICE (Innovation Centre for Education)
IBM Power Systems

• Xiao Steganography

• Image Steganography

• Steghide

• Crypture

• SteganographX Plus

• rSteg

© Copyright IBM Corporation 2016

Tools for Steganography – Overview 2 IBM ICE (Innovation Centre for Education)
IBM Power Systems

• SSuite Picsel

• Our Secret

• Camouflage

• OpenStego

• SteganPEG

• Hide’N’Send

© Copyright IBM Corporation 2016

Tools for Steganography – Overview 3 IBM ICE (Innovation Centre for Education)
IBM Power Systems

• Hydan

• Stegdetect (Provos 2004)

• StegFS

• FreeOTFE

• TrueCrypt

• Steghide

© Copyright IBM Corporation 2016

Data Hiding IBM ICE (Innovation Centre for Education)
IBM Power Systems

• Data Hiding is an ancient art.

• Caesar cipher.
• Egyptians used symbolic language in their pyramids.
• Coded Language.
• Writing with invisible ink.
• With the dawn of the Digital World, now just the methods have changed, but the aim is still
the same.

Data Hiding Techniques and Proposed Advantage(s) for

• Still Image
• Audio Signal
• IPv4 Header

© Copyright IBM Corporation 2016

Data Hiding - Generic IBM ICE (Innovation Centre for Education)
IBM Power Systems

• Generic Data Hiding

– Data can also be hidden in unallocated or otherwise unreachable locations that are ignored by the
current generation of forensic tools.

• Properties of Data Hiding

• There are several reasons to hide data as well.

• Current/future trends in the data hiding techniques domain

© Copyright IBM Corporation 2016

Data Hiding and Steganography IBM ICE (Innovation Centre for Education)
IBM Power Systems

• Steganography is an effective way of secure communication.

• Sample technique for hiding data using steganography techniques involve using :
• System commands on a command prompt
• Using a software tool to hide data.

© Copyright IBM Corporation 2016

Alternate Data Stream (ADS) IBM ICE (Innovation Centre for Education)
IBM Power Systems

Alternate Data Stream (ADS) was implemented in order to allow compatibility

with the Hierarchical File System(HFS).
HFS stores its data in two parts;
– Resource fork.
– Data fork.
The Data fork is where the data is actually contained and the resource fork is
used to tell the operating system how to use the data portion.
Windows does the same thing through the use of extensions such as .bat,
.exe, .txt, etc.

© Copyright IBM Corporation 2016

Data Recovery IBM ICE (Innovation Centre for Education)
IBM Power Systems

• Data loss can take many forms

– accidental deletion,
– hard drive failure,
– software bugs,
– data corruption,
– hacking,
– even a simple power failure can cause you to lose data.

• And, of course, there are more extreme cases, like when a hard drive is recovered from a
plane crash; amazingly, some data recovery specialists can retrieve data from storage media
that’s been almost completely destroyed.

• Tips for Data recovery: Do’s and Don’t’s

• Recuva, a tool for Data recovery.

© Copyright IBM Corporation 2016

Reasons Data Recovery IBM ICE (Innovation Centre for Education)
IBM Power Systems

The methods used to recover lost data depend on how the data was lost in the first place; let’s
take a look at some of the most common forms here.
• File Deletion
• File Corruption
• File System Format or Damage

• Physical Damage
– Physical damage may be dealt with by replacing old parts.
The process of repairing physical damages may allow the user to use the hard disk, though it may not
be sufficient for the computer to run in its entirety since Logical damage may be still be present.

• Logical Damage
– Logical damage means that the system or storage may be corrupted due to unintentional partition,
accidental formatting and deletions, power failure, virus attacks or memory overflow.

© Copyright IBM Corporation 2016

Data recovery chances IBM ICE (Innovation Centre for Education)
IBM Power Systems

The methods used to recover lost data depend on how the data was lost in the first place.
• To get the best possible data recovery result it is strongly recommended to stop any write
access to the storage and run data recovery software immediately.

Chances of data recovery for:

• Data loss caused by file deletion
• Recovery after file system formatting
• Recovery after file system damage
• Loss of information about partition
• Hardware failure
• Recovery of wiped/overwritten data

© Copyright IBM Corporation 2016

Data Recovery Technique IBM ICE (Innovation Centre for Education)
IBM Power Systems

1. Use of software to recover data

2. Use of machines to recover data

• Scanning Probe Microscopy (SPM)

• Magnetic Force Microscopy (MFM)
• STM (Scanning Tunneling Microscopy)

© Copyright IBM Corporation 2016

Data Recovery – Scenario IBM ICE (Innovation Centre for Education)
IBM Power Systems

• Electronic data is part of all of our lives, some is business and some is pleasure.
• The loss of either can devastate you financially, emotionally or both. There are several ways
that data can become inaccessible to you.
• Most of these failures are recoverable, some of them are not.

Recoverable failures and Unrecoverable scenarios involving.

1. The Individual
2. Business Critical Data
3. Post Failure
4. The Fatal Mistake

© Copyright IBM Corporation 2016

Data Loss prevention IBM ICE (Innovation Centre for Education)
IBM Power Systems

• The best way to address data loss is to prevent it from occurring in the first place.

• Data backup permits the user to restore any file or data if ever logical or physical damage
occurs.

• External protection must also be observed. Hard disk drives are sensitive.

• Not all data can be recovered. There may be cases where it is impossible to repair or retrieve
any data because of the severe damage obtained by the hard disk, particularly the platter.

© Copyright IBM Corporation 2016

Disk Imaging Technique IBM ICE (Innovation Centre for Education)
IBM Power Systems

• There is specialized software that can extract corrupt data with the exception to physically
damaged disc. Although it is no way complete, any data recovered can be reconstructed for
reference. Mostly, data recovery through Imaging involves the following:
– Access the hard drive directly instead of being dependent to the Operating System as set by its BIOS
configuration.
– Reading the Bad Sector instead of skipping it.
– Overriding resetting / restarting command when reading the disk.

• The imaging technique specializes on getting what can be "read" on the entire disk by
avoiding any command that will restart the process once an error is detected, after this data
reconstruction follows.

© Copyright IBM Corporation 2016

Checkpoint IBM ICE (Innovation Centre for Education)
IBM Power Systems
1. What is Steganalysis?
A. Steganalysis is analysis of Cryptography
B. Steganalysis is study of Bitcoins
C. Steganalysis is simply the detection of steganography by a third party.
D. Steganalysis is similar to Watermarking

2. What are common forms of loss of Data?

A. Traffic Loss
B. File Deletion, File Corruption, File System Format or Damage
C. Data Complexity
D. Data Duplicity

3. What is involved in data recovery through Imaging

A. Use Decryption tool to extract data
B. Access the hard drive as set by its BIOS configuration, Reading the Bad Sector, Overriding
resetting / restarting command when reading the disk.
C. Magnify the image
D. Use a Hashing tool

© Copyright IBM Corporation 2016

Checkpoint IBM ICE (Innovation Centre for Education)
IBM Power Systems

4. ____________ was implemented in order to allow compatibility with the Hierarchical File System(HFS).
A. Active Data System
B. Active Data System
C. Forensic Data System
D. Alternate Data Streams

5. Data hiding only hides _____________, whereas data encapsulation hides

_______________________.
A. class data parts and private methods
B. class data components, class data parts and private methods
C. class data components, class data parts
D. class data components, private methods

© Copyright IBM Corporation 2016

Checkpoint solutions IBM ICE (Innovation Centre for Education)
IBM Power Systems

1. C
2. B
3. B
4. D
5. B

© Copyright IBM Corporation 2016

Unit summary IBM ICE (Innovation Centre for Education)
IBM Power Systems

Having completed this unit, you should be able to

• Understand Steganography
• Understand Steganalysis, its hierarchy, types and functions
• Learn the Tools for Steganography
• Understand Data Recovery Techniques

© Copyright IBM Corporation 2016