
Steganography Analyzer Artifact Scanner (StegAlyzerAS) is a digital forensic analysis tool designed to extend the scope of traditional digital forensic examinations by allowing the examiner to scan suspect media or forensic images of suspect media for known artifacts of steganography applications.
Artifacts may be identified by scanning the file system as well as the registry on a Microsoft Windows® system. StegAlyzerAS allows for identification of files by using CRC-32, MD5, SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512 hash values stored in the Steganography Application Fingerprint Database (SAFDB). SAFDB is the largest commercially available steganography hash set. Known registry keys are identified by using the Registry Artifact Key Database (RAKDB) distributed with StegAlyzerAS.