Question

Consider this scenario. Miguel is an experienced forensic evidence analyst. During a particular forensic investigation process he encounters two separate files with a 100KB text message and a 1MB message hidden in a 2MB image file of respectively.

1. Which one will Miguel find harder to detect?

2. Why? (Explain (2 points) AND use numeric calculations to show why

Answer 1

Miguel is likely to find the 100KB text message hidden in a 2MB image harder to detect compared to the 1MB message, because the size difference represents a smaller proportional change, making it less noticeable.

Step-by-step explanation:

The student's question involves the comparison of two scenarios in which hidden data needs to be detected in a digital file. Miguel, an experienced forensic evidence analyst, is more likely to have a harder time detecting a smaller change in size, which in this case is the 100KB text message hidden in the 2MB image file. To understand why this is the case, consider the proportional difference between the original and the modified files:

• 
  
• The 2MB image file with a hidden 100KB message would result in a file that is approximately 2.1MB, resulting in a 5% (100KB/2MB) relative change in size.
• 
  
• The 2MB image with a hidden 1MB message would result in a 3MB file, which is a 50% (1MB/2MB) relative change in size.

The principle here is that a proportional change is easier to detect when the percentage of change is greater. Therefore, a 5% change (100KB hidden in 2MB) is less noticeable than a 50% change (1MB hidden in 2MB). This is analogous to the concept that a difference between 20 and 21 units of weight is more detectable than a difference between 1 and 2 units, due to the relative magnitude of the change.