Stego key searching for LSB steganography on JPEG decompressed image

At present, steganalysis research focuses on detecting the existence of a hidden message. However, extracting the hidden information, i.e., an extracting attack, is crucial in obtaining effective evidence in computer forensics. Due to the difficulty of an extracting attack, research in this field is limited. In steganography with a stego key, an extracting attack is equivalent to recovering the stego key. In this paper we study a method for recovering the stego key in least significant bit （LSB） steganography with a decompressed JPEG image as the cover image. Firstly, the recovery of the stego key is translated into a cryptanalysis problem for a sequential cipher. The method for recovering the stego key is based on estimating the modification positions. The minimum size of the data used to recover the stego key successfully is discussed. Secondly, when a decompressed JPEG image is used as the cover image, the probability of recovering the cover pixels using recompression is discussed. Recompression is used to compute the error of the estimated sequence. Finally, an algorithm to recover the stego key in LSB steganography with a decompressed JPEG image as the cover image is proposed. The experimental results for the steganographic software, Hide and Seek 4.1 and its variant, which is a typical representative of LSB steganography, show that the proposed method can successfully recover the stego key in LSB replacement and LSB matching, i.e., the extracting attack is successful, and it outperforms three previous methods in terms of computational complexity.