Seminars & Training

December 14 - 15, 2006

MUFSC hosts SARC's: Steganography Examiner Training

Course Description:

Upon completion of this comprehensive two day course, students will have the tools and experience needed to detect the presence and use of digital steganography applications as part of their computer forensic examinations. Students will gain an understanding of the threat posed by the use of steganography in today's interconnected digital world. Students will become familiar with various techniques and methods used for embedding hidden information within carrier files. Students will also gain hands-on experience using a variety of steganography tools while learning how the tools manipulate carrier files.

Students will learn about the Analytical Approach to Steganalysis: an approach developed by the Steganography Analysis and Research Center (SARC) as a result of extensive research of steganography applications and the techniques they employ to embed hidden information within carrier files. The premise of the Analytical Approach is to first determine if a particular steganography application existed on storage media at one point in time. Next, potential carrier file types are identified and examined for known signatures of steganography applications. Once steganography signatures are detected, extraction of the hidden information is possible.

Students will conduct a complete steganography examination from initial suspicion and analysis to detection and recovery of hidden information. The Steganography Analyzer Artifact Scanner (StegAlyzerAS) will be used to scan suspect media for the presence of steganography application artifacts. Students will also learn how to scan for artifacts in the Microsoft Windows® Registry, a feature exclusive to StegAlyzerAS. The Steganography Analyzer Signature Scanner (StegAlyzerSS) will be used to identify files containing signatures of steganography applications. Students will learn how to use Automated Extraction Algorithms to extract hidden information from carrier files with a simple “point-click-and-extract” interface, a feature exclusive to StegAlyzerSS.

Classes begin at 9:00am and run until 5:00pm both days. Steganography Examiner Training consists of six hours of lecture, six hours of practical laboratory exercises, and a two hour written and practical examination.

All students are provided with their own notebook computer containing all tools and laboratory exercises needed for the course. All students will receive a reference CD containing copies of the steganography tools used to hide information as well as all training materials and laboratory exercises. All students who pass the written and practical examination will receive a "Certified Steganography Examiner" certificate.

If software is purchased with training, the student will also receive fully licensed copies of StegAlyzerAS and StegAlyzerSS. These licenses include all product updates for one year after the class.

Training Information:

Duration: 2 days (14 hours)
Prerequisites: See Description
Lead Instructor: Various
Registration: James Wingate, Chad Davis, or Robert Lipscomb
Location: Marshall University Forensic Science Center, Huntington, WV,
Time: 9:00am to 5:00pm each day
Discounts: Law Enforcement professionals recieve free training.
Software available for $795.00.

We accept MasterCard, Visa, Discover Card, and American Express.

Price with software: $1195.00 includes the following:

  • Two-day steganography Examiner Training
  • Full license to the Steganography Analyzer Artifact Scanner (StegAlyzerAS)
  • Full license to the Steganography Analyzer Signature Scanner (StegAlyzerSS)

Price without software: $400.00 includes the following:

  • Two-day Certified Steganography Examiner™ Training

To reserve your space, contact:

  • James Wingate, Chad Davis, or Robert Lipscomb
  • 1-866-401-9392

Visit SARC's official website: