_____________________________

IJoFCS (2015) 1, 23-28

The International Journal of
FORENSIC COMPUTER SCIENCE
_____________________________
www.IJoFCS.org
DOI: 10.5769/J201501003 or http://dx.doi.org/10.5769/J201501003

Detection of Steganography using Metadata in Jpeg

Files
Don Caeiro1, and Sanjana S2
(1) Assistant Professor, Jain University, Bangalore, India, Email: [email protected]
(2) B.Sc. Forensic Science Student, Jain University, Email: [email protected]

Abstract: Steganography is to conceal information in a carrier file or cover file. This is done to make
secure communications without attracting attention of any other person except the sender and the
receiver. This paper deals with digital steganography. The carrier file used in this study is JPEG
images. The hidden data is in various formats like audio, video, plain text, and pdf formats. The cover
image with hidden data in it is called the steganography file. The files were steganographed using
various applications like Quick Stego, Invisible secrets, Our secret and Steg. When data is
incorporated to the original file there will be changes done to the integrity of the file that is not visible
on viewing the file. This data added is hidden in the file. Therefore there is possibility that the metadata
of the file changes and hence metadata analysis can be done to detect steganography..

Key words: Steganography, metadata, digital forensics, Jpeg analysis, steganalysis, computer
forensics, integrity, exif data.

1. Introduction image, video etc. The carrier file along with the
embedded data is the stego-carrier.
Steganalysis is the ability to detect the embedded
Steganography is to conceal or lurk information in
message in the digital media concealed by
a carrier file or cover file. In order to relegate
steganography and recognizing the
privacy, multitudinal methods have been
steganographic algorithms.
established and incorporated. Steganography is
hiding the text as it is in a cover file, which cannot
be noticed by anyone. The advantage of 2. Types Of Steganalysis:
steganography over cryptography is that the file
does not gain attention of the public, as only the 1. Visual detection: The original file and the
sender and the receiver are aware of the steganography files are compared for any visual
message embedded in it. differences with the naked eye. Repeated
patterns or small distortions may reveal the
Steganography involves a carrier file which holds presence of the secret message.
the information that is to be hidden. The data to 2. Statistical detection: The statistics of an image
be hidden can be in any form like plain text, are altered as information is embedded into it.
This method identifies the underlying statistics of

___________________________________
th
Paper submitted on: October 26 , 2015
24 Detection of Steganography using Metadata in Jpeg Files ___________________________________

the file and detects the hidden data in the file. original information of the image or part of the
There are two types of statistical analysis: image data is lost or cannot be restored.
a) Specific statistical steganalysis: These b. Progressive encoding: In this encoding
techniques are determined by going through the method, the data is compressed in multiple
embedding operation and certain image statistics. passes of progressively higher detail, which is
Such techniques need more knowledge about the ideal for larger images.
embedding process. 5. Bit depth: It tells us the number of colors in an
b) Universal statistical steganalysis: This image’s color palette. Higher the bit depth, more
technique uses the statistical steganalysis colors the image can store.
method that is not made for a specific
steganography embedding method. 3. Methodology
This study does not use the above techniques
and this has been briefed just to throw light upon
the existing techniques. Structural detection Four applications used for steganography were
technique, which has been explained below is the downloaded. The four applications are Invisible
technique used for the analysis in this study. secrets, Quick stego, Our secret, and Steg. For
3. Structural detection: Structural detection is metadata extraction, Exif tool and Jeffrey's Exif
done by comparing the metadata of the original Viewer were used. Twenty JPEG files were
file and steganography file. There will be segregated in a separate folder called original
noticeable changes in the values of the attributes files. Separate folders were made under the
like file size, comment, bit rate, etc. folder original files for different applications used
Metadata can be described as “data about data”. for steganography and five files were put in each
It gives additional information about certain file’s folder for steganography. This was done to
content. For example, in an image file, it gives monitor which tool was used to conduct
information about color depth, image height, steganography a particular image. Then another
image width, dimension unit, mime type, folder called steganography files was created.
encoding process etc, it also includes data about Under this folder, another four folders in the name
when the file was created, last accessed and of the four applications used for steganography
modified. was created so that the file can be directly saved
Few attributes are explained below: in that respective folder after performing
1. File type: File type describes how the data has steganography. Then the original files were
been stored in the file, i.e. the structure and processed using the steganography tools and
contents of the file. Each file type has an were saved in their respective folders. The data
extension. Few image file types are JPEG, BMP, hidden in the images were randomly selected.
PNG, GIF, and TIFF. The data used for hiding is in different formats
2. MIME: MIME stands for multi-purpose internet like plain text, audio, video, and pdf formats. The
mail extension. This is a standard way of data hidden in each image was noted down. This
classifying files. MIME has two parts: a type and completes the process of steganography.
sub type. For example, an image file has a
image/jpeg The next step is to extract metadata of the
3. Resolution: It is the number of pixels in the original file and the steganography file and
image usually represented in (width x height) like compare them for changes in the properties of
2000 x 3000 pixels. It may also be given in the the files. The metadata has to be extracted from
total numbers of pixels like 4 megapixels. forty files, i.e. twenty original files and twenty
4. Encoding process: It is the process of putting steganography files. First the metadata of the
the sequence of characters like numbers letters original file was extracted using exif tool. Next the
or symbols in a particular digital format for metadata of the same file which was
efficient transmission. Few types of encoding Steganographed was extracted. Since the data
methods are: extracted from this application cannot be copied,
a. Baseline encoding: This method usually screenshots were taken and saved. The same
encodes in lossy format which means some process was done with all the forty files and
_______________________________________________________________ Don Caeiro and Sanjana S 25
screenshots were taken. After this, the metadata Color Compo 3 3
was extracted using Jeffrey’s Exif Viewer online nents
tool. The same process was carried out. The File Size 165 kB 797 kB
metadata was extracted from the original file and Image Size 1,440 × 900 1,440 × 900
its identical steganography file. The extracted Y Cb Cr Sub YCbCr4:2:0 (2 YCbCr4:2:0 (2
metadata was noted down. This was done for all Sampling 2) 2)
the forty files. The metadata extracted from two Comments CREATOR: %a2%8c0B!%
tools was compared. They were same and few gd-jpeg v1.0 a9%8e%ac%a
additional attributes were found for few files. The (using IJG 2%cb%f5xN1~
metadata extraction was complete. The metadata JPEG v62), %ae%fb%92%
was tabulated and compared for analysis. quality = 90 10]|%17%15%
e3%fe%e2%b9
Structural detection method has been used in this
%14%a5%f2%
study, i.e. the changes in properties of the file like e6%11%8f%a2
resolution, bit depth, file size, encoding process %8b%b9%db
and so on for Steganalysis. There were changes %cch.%ff%0f%
observed in the properties of the file and they c4ew%18%8fk
have been discussed below. w%a7%8d%b0
>v%cc%81%8
b%c8Q%caf.%
3. Findings ba%d7A%9bR
%ed%ca%b81
1. Invisible secrets: The five files processed using <%d2%db%18
invisible secrets have shown few similarities. %a0%f7g[%f3
There are changes in the file size. It loads a U]%8ef%aa%a
comment when there is no comment in the a%aa%aa%0f.t
original file. If a comment is already present in the mN%00%00%
00t%e0
original file, the comment is changed. It does not
alter any other attributes. The differences in file
size are very large which indicates 1. Our secret: The five files were subjected to
steganography. However, JPEG images with steganography using Our Secret has
large file size arises suspicion on the image. differences only in one attribute, i.e. file size.
It has not made any changes to encoding
Table 1.1: Showing metadata of image 5 process, resolution, creator tool, original
steganographed with Invisible Secret. document ID and file type, which makes it
ATTRIBUTE ORIGINAL STEGANOGR difficult to suspect steganography. The
S FILE APHED FILE difference in the file size depends on the size
File 1,440 × 1,440 ×
of the data hidden.
900 JPEG 900 JPEG
(1.3 megapixel (1.3 megapixel 2. Quick Stego: The five files were processed
s) s) using Quick Stego have shown differences in
168,854 bytes 816,342 bytes few attributes. The main difference is the
(165 kilobytes) (797 kilobytes) change in file format. The original files are in
JFIF Version 1.01 1.01 JPEG format and the output image after
Resolution 1 pixels/None 1 pixels/None steganography is in BMP format. The MIME
type also differs due to the change in file type.
File Type JPEG JPEG
The file size also varies and the differences
MIME Type image/jpeg image/jpeg
are large. Few attributes like compression, bit
Encoding Pro Baseline DCT, Baseline DCT,
cess Huffman Huffman
depth and planes have been found in the
coding coding steganography files which may be added due
Bits Per Sam 8 8 to the change in file type. Other attributes like
ple encoding process, bits per sample, color
26 Detection of Steganography using Metadata in Jpeg Files ___________________________________

components, resolution which was there in Table 1.3: Showing metadata of image 5
the original file has not been found in the steganographed with Quick Stego
steganography file.

3. Steg: The five files were processed using

Steg has shown differences in few
attributes. The major difference is the
encoding process. The original files have
Progressive DCT, Huffman encoding and
the encoding process in the
steganography files have been changed
to Baseline DCT, Huffman encoding. The
Progressive DCT, Huffman encoding is
used in larger images with more clarity.
Here the encoding is changed to Baseline
DCT, Huffman encoding which has less
clarity.

Table 1.2: Showing metadata of image 5

steganographed with Our Secret
ATTRIBUTE ORIGINAL STEGANOGRAPH
S FILE ED FILE
File 200 × 200 × 200 JPEG
200 JPEG 9,254 bytes (9
9,042 bytes kilobytes)
(9 kilobytes)
JFIF Version 1.00 1.00
Resolution 150 150 pixels/inch
pixels/inch
File Type JPEG JPEG
MIME Type image/jpeg image/jpeg
Encoding Pr Baseline Baseline DCT,
ocess DCT, Huffman coding
Huffman
coding
Bits Per Sam 8 8
ple
Color Comp 3 3
onents From table 4.4, we can say that the
File Size 8.8 kB 9.0 kB comment present in the original file
Image Size 200 × 200 200 × 200 cannot be found in the steganography file.
Y Cb Cr Sub YCbCr4:2:0 YCbCr4:2:0 (2 2) The file size also differs but the difference
Sampling (2 2) is very less. The difference in file size is
less because after selecting the carrier
file, the software suggests the space
available to hide data.
_______________________________________________________________ Don Caeiro and Sanjana S 27

3. Conclusion Steg: The encoding process has been

changed from Progressive DCT, Huffman
Invisible Secrets: The presence of the encoding to Baseline DCT, Huffman
comment in the steganography file and the encoding. The comment in the original file
differences in the file size indicates that the has not been found in the steganography file.
files were steganography files. There are differences in the file size. All these
differences indicate that the files are
steganographed.
Table 1.4: Showing metadata of image 5
steganographed with Steg. Therefore from this study it is observed that
there are definite changes made to the
ATTRIBUTES ORIGINAL FILE STEGANOGRA metadata of steganography files. During
PHED FILE
computer forensic investigation, metadata
File 800 × 800 × analysis of suspected images can be done in
520 JPEG 520 JPEG
161,822 bytes 192,573 bytes order to detect steganography to a certain
(158 kilobytes) (188 kilobytes) extent. Once a file has been detected to be a
JFIF Version 1.01 1.01 steganography file, it can further processed
Resolution 72 pixels/inch 72 pixels/inch
to be decrypted in order to obtain the hidden
information.
File Type JPEG JPEG
MIME Type image/jpeg image/jpeg
References
Encoding Proces Progressive Baseline DCT,
s DCT, Huffman Huffman coding
coding [1] Adrian VASILESCU, B. R. (2007).
Bits Per Sample 8 8 Steganographically Encoded Data.
Color Componen 3 3 [2] Arvind Kumar, K. P. (November 2010).
ts Steganography- A Data Hiding Technique.
File Size 158 kB 188 kB Meerut, India.
Image Size 800 × 520 800 × 520 [3] Bateman, P. (4th August 2008). Image
Y Cb Cr Sub YCbCr4:4:4 (1 1) YCbCr4:4:4 (1 1) Steganography and Steganalysis. United
Sampling Kingdom.
[4] Cancelli, I. G. (May 13th, 2009). New
techniques for steganography and
Our Secret: The difference in the file size steganalysis in the pixel domain.
indicates that the files were subjected to
[5] Cheddad, A. (march 2010). Digital Image
steganography. Steganography : Survey and Analysis of
Current Methods. United Kingdom.
Quick Stego: There is a change in the file
format from JPEG to BMP and hence the [5] D.Streetman, K. Steganography-Art of Covert
Communications.
MIME type changes. The file size differs and
there are few attributes added to the [6] Ekta Dagar, S. D. (May 2014). Comparative
steganography file due to the change in file Study of Various Steganography Techniques.
format. Few attributes present in the original Faridabad, India.
file is also not present in the steganography [7] Fridrich, J. Steganalysis of JPEG Images:
file. All these changes indicate that the files Breaking the F5 Algorithm. Binghamton.
have been subjected to steganography.
28 Detection of Steganography using Metadata in Jpeg Files ___________________________________

[8] Goel, P. (May, 2008). Data Hiding in Digital [11] peter bayer, h. w. (august 2002). Information
Image : A Steganographic Paradigm. hiding: steganographic content in streaming
Kharagpur. media. Sweden.
[9] KUMAR, M. (2011). STEGANOGRAPHY AND [12] Richer, P. (2003). Steganalysis: Detecting
STEGANALYSIS OF JOINT PICTURE hidden information with computer forensic
EXPERT GROUP. FLORIDA. analysis.
[10] Ling, L. S. (2005). Study of Steganographic [13] YANG, Y. (2013). Information Analysis for
Techniques for Digital Images. October. Steganography and Steganalysis in 3D
Polygonal Meshes. Durham University.