In this lesson, you learned that steganography is the science of hiding secret data within nonsecret data. Today, multimedia files, such as pictures or sound, are the most common carrier messages. The readings in this lesson described several steganography software tools that can be used to embed hidden data, often legitimately, within an image. Steganalysis software can detect the presence of that hidden data.

In this lab, you will use P2 Commanders Image Analyzer to automate image analysis to identify suspect files that may be useful in a forensic investigation. You will use P2 Commanders sort features to sort the files on the evidence drive into categories for easier analysis. You will also document your progress throughout the lab.

1. Why might it be important to confiscate and identify the websites and kinds of images found on a suspects computer?

2. Explain what the P2 Commander Image Analyzer does and what it looks for.

3. How do you decrease the amount of false positives in the Highly Suspect or Suspect categories?

4. Into how many different categories does P2 Commanders Sorted Files feature categorize all of the identified files? What are these categories?

5. How many files did the Sorted Files feature identify on the evidence drive?

6. Where would you look to identify a rogue application, malicious spyware application, or keyboard logger application on the target evidence drive?

7. Where would you look to identify ZIP files and compressed files that may actually contain embedded malicious software?

8. Where must you also look to examine possible image files on the evidence drive under investigation?

9. Why is it also important to look under the Graphics folder directly under the Sorted tree as well as the Image Analyzer Results category?