Steganography

Forensic evidence ranges from the readily evident (i.e., stab or gunshot wound) to the harder to detect (i.e., trace evidence) to the invisible or disguised. Whether apparent or not, all evidence is potentially valuable in tracing the course of events of an accident, illness, or crime, and in personal identification. Disguised or hidden evidence can be physical or, in the case of computer forensics, electronic. An example of the latter is steganography.

Steganography (from the Greek for "covered writing") is the secret transmission of a message. It is distinct from encryption, because the goal of encryption is to make a message difficult to read, while the goal of steganography is to make a message altogether invisible. A steganographic message may also be an encrypted as an extra barrier to interception, but need not be. Steganography has the advantage that even a talented code-cracker cannot decipher a message without knowing it is there.

Steganography has been used since ancient times; Greek historian Herodotus records how one plotter of a revolt communicated secretly with another by shaving a slave's head, writing on his scalp, letting his hair grow back, and sending the slave as an apparently unencumbered messenger. The number of ways a steganographic message might be sent is limited only by human ingenuity. A photograph of a large group of people, for example, might contain a Morse-code message in the expressions of the people in the photograph (e.g., smiling for dot, blank for dash) or in the directions they are looking (e.g., slightly to the left for dot, straight at the camera for dash). Writing in invisible ink or miniaturizing a message, as on microfilm, are also forms of steganography. Probably the commonest form of steganography involves the embedding of messages in apparently innocent texts, with the letters or words of the message indicated either by subtle graphic emphasis (e.g., heavier ink, lighter ink, a small defect) or by special positioning. For instance, reading the first word of every sentence in what appears to be an ordinary letter might yield a steganographic message.

Like most other forms of cryptography and secret writing, steganography has thrived in the digital era. Most digital documents contain useless or insignificant areas of data, or involve enough redundancy that some of their information can be altered without obvious effect. For instance, one might conceal a message bitstream inside a digital audio file by replacing the least-significant bit of every waveform sample (or every nth waveform sample) with a message bit; the only effect on the file, if played back as audio, would be a slight, and probably unnoticeable, decrease in the sound quality. Although steganographic messages can be hidden in any kind of digital files, image files, because they contain so much data to begin with, are usually used for digital steganography. Today a number of commercial or shareware programs exist for encoding text into steganographic images, called stego-images), and are used by millions of people worldwide who wish to evade surveillance.

Steganography is also used for watermarking, which is the hiding of information indicating ownership or origin inside a digital file. (Physical watermarking, the practice after which digital watermarking is named, is the impression of a subtle pattern on paper using water. A watermark is only visible when the paper is held up to a light.) Watermarking can be used by forensic investigators for digital authentication (i.e., to prove that certain party was indeed the source of a file) or to check whether a digital file was obtained in violation of copyright.