Steganography & File Carving

Steganography and file-carving tools answer "is something hidden in this image / firmware blob / disk fragment?" Heavily used in CTFs, sometimes useful in IR / DFIR. For broader RE see Reverse Engineering (Ghidra). For DFIR carving see DFIR (Velociraptor). For EXIF-only metadata see Photo EXIF Metadata. For CTF tooling see CTF Tools (pwntools).

File / firmware carving

• ★ binwalk — extract embedded files, file-systems, firmware images. Free. The reflexive first-thing.
• ★ unblob (Onekey) — modern Rust extractor; better than binwalk for 2024+ firmware formats. Free.
• foremost — header-based carver.
• scalpel — foremost successor; configurable carving patterns.
• bulk_extractor — strings / emails / IPs / pcaps / credit cards from disk or memory.
• photorec / testdisk — file recovery from corrupted disks.
• strings / xxd / hexdump — never not useful.

Image steganography

• ★ zsteg — PNG / BMP LSB steganography detector / extractor; the default. Free.
• stegoVeritas — modern image stego analyser.
• StegSolve — Java GUI; flip through colour planes / bit planes manually.
• Stegseek — fast steghide brute-force.
• steghide — classic JPEG / WAV / BMP stego (encrypt + hide).
• OpenStego — Java; LSB hide.
• Stegano — Python lib.
• zsteg + StegSolve + steghide + Stegseek — together they cover ~95% of CTF image-stego.

Audio / video stego

• Sonic Visualiser / Audacity — spectrogram view; classic "look at the spectrogram" challenges.
• DeepSound — Windows; audio stego.
• MP3Stego — JPEG-style stego for MP3.
• ffmpeg / mediainfo — strip / inspect.

Document / archive

• pdftohtml / pdftk / qpdf / pdf-parser.py — PDF dissection.
• oletools — Office documents; see Malware Analysis.
• 7z / unzip — try every extraction shape; embedded zip / rar in PNG is a CTF trope.
• stegcracker — brute-force steghide passphrases.

Metadata

• ★ ExifTool — metadata reader / writer; works on every format. Free. See Photo EXIF Metadata.
• mediainfo / mediaprobe — A/V metadata.
• exif (older).

Network / pcap forensics

• NetworkMiner — extract files / certs / sessions from pcap.
• Wireshark — full packet review.
• tshark / tcpflow — CLI pcap tools.
• chaosreader / Wireshark "Follow Stream" — extract sessions.
• Brim / Zui (Brim Data) — pcap + Zeek for fast triage.

Disk / volume

• The Sleuth Kit — disk-image forensic library; underlies Autopsy. See DFIR.
• fls / icat / mmls — Sleuth Kit CLI.
• dd / dcfldd / FTK Imager — imaging.
• TestDisk / PhotoRec — recover deleted files.

Specific format tricks

• PNG: chunks — pngcheck, zsteg, pngquant, manual chunk surgery.
• JPG: trailing data — binwalk -e file.jpg; check beyond the FFD9 marker.
• GIF: frame extraction — convert image.gif -coalesce frames%d.png.
• WAV / FLAC — spectrogram + LSB.
• PDF — pdf-parser.py, hidden objects, embedded JS.
• ZIP — comments, polyglots, extra fields.

Pick this if…

• Default firmware / file carve: unblob (modern) + binwalk.
• PNG / BMP LSB: zsteg + StegSolve.
• steghide-encrypted file: Stegseek brute-force.
• Image metadata: ExifTool.
• Audio CTF: Audacity / Sonic Visualiser spectrogram.
• Disk recovery: PhotoRec / TestDisk.
• PDF investigation: pdf-parser.py + pdftk + qpdf.
• Pcap file extraction: NetworkMiner.