In this lesson, you learned that steganography is the science of hiding secret data within nonsecret data. Today, multimedia files, such as pictures or sound, are the most common carrier messages. The readings in this lesson described several steganography software tools that can be used to embed hidden data, often legitimately, within an image. Steganalysis software can detect the presence of that hidden data.

In this lab, you will use P2 Commanders Image Analyzer to automate image analysis to identify suspect files that may be useful in a forensic investigation. You will use P2 Commanders sort features to sort the files on the evidence drive into categories for easier analysis. You will also document your progress throughout the lab.

1- Where would you look to identify a rogue application, malicious spyware application, or keyboard logger application on the target evidence drive?

2- Where would you look to identify ZIP files and compressed files that may actually contain embedded malicious software?

3- Where must you also look to examine possible image files on the evidence drive under investigation?

4- Why is it also important to look under the Graphics folder directly under the Sorted tree as well as the Image Analyzer Results category?