- Analyses image files for steganographic content
- Runs statistical tests to determine if steganographic content is present
- Attempts to find the system that has been used to embed the hidden information
$ stegdetect 3301.jpg
3301.jpg : appended(61)<[nonrandom][ASCII text][TIBERIVS CLAVDIV]>
This shows 61 appended bytes of ASCII text and the letters. A tail of the file shows :
$ tail --bytes=61 3301.jpg
TIBERIVS CLAVDIVS CAESAR says "lxxt>33m2mqkyv2gsq3q=w]O2ntk"
Note : the '-c' option of tail could have been used in place of '--bytes=61"
This is a shift or ceasar cipher with ”lxxt>33″ being “http://”. This then allows the substitution of 4 characters to be deduced leading to