A Non-Algorithmic Forensic Approach for Hiding Data in Image Files

Abstract

Digital evidence continues to be an integral component in investigative and judicial processes. In digital files, information is stored in structured containers to enable software applications to process and render it for use. In this work, we extend prior research into non-algorithmic approaches to data hiding in files whose structural and physical properties are based on Office Extensible Markup Language (OOXML) by extending and applying our approach to digital image files. The file structure and properties of digital images is inherently different from OOXML files. In this paper, we propose a technique for creating persistent, stealthy, and benign tagging data in digital files. Our approach differs from current steganographic and cryptographic methods because we use a black box approach to find patterns of candidate file locations for inserting our digital tagging data. The results in this paper demonstrate that it is possible to empirically find locations suitable for storing data without knowledge of the files' internal structure, and to essentially hide persistent and benign tagging data in JPEG files. We observed that 31% of the inserted tagging data survives when our test image files are modified and saved or when opened and saved without modifying. Additional experiments revealed that hidden data in identified locations persists when operations like opening, closing, terminating, copying are performed on the image files.