Steganalysis — Detection Tactics

How to determine whether hidden data exists, where to look, and what signals to trust. This skill complements steganography-analyst (which handles extraction).

Core Principle

Steganalysis is observation-first. Before running any tool, ask: what about this file is unusual, inconsistent, or suspicious? The answer guides which extraction techniques to try.

1. Contextual Signals

The richest detection channel is often not the file itself but its context.

Challenge / Source Metadata

• Challenge descriptions frequently encode hints: "the answer is in the red," "look deeper than the surface," "not everything is as it appears"
• File names may be literal: hidden.png, secret.wav, challenge_not_what_you_think.txt
• File provenance: Where did this come from? A "screenshot" that's 2MB is suspicious. A "photo" that's 300KB with no EXIF camera data is suspicious.
• Multiple files in a challenge: One may be the key/password for another. Look for relationships.