A New Approach of Computer Forensics Based on Steganalysis

Criminals often destructed or hided evidence after making crime by computer, they hindered computer forensics by anti-forensics technology. A new approach of computer forensics based on steganalysis is proposed. The common anti-forensics technologies, such as steganography, data encryption delete evidence and make forensics invalid. In order to enhance the evidence efficiency, steganalysis is applied in the computer forensics to collect and transfer evidence. Simulation results show that steganography based on least significant bit (LSB) by java program embeds the text files into the BMP image files, which sizes are nearly invariable. Steganalysis restores the hidden information and provides convenient method for computer forensics.