Exam 312-49v11 Topic 11 Question 312 Discussion

The correct choice is D because stego-only analysis is the method used when investigators have access only to the suspected stego-object and do not possess the original cover object or the embedding algorithm. This is exactly the limitation described in the question. In CHFI v11, anti-forensics techniques include steganography, and exam questions often test whether the examiner can identify the correct analytical model based on what evidence is available. Known-cover analysis would require both the clean original cover file and the modified stego-object. Chosen-stego would require knowledge of the steganographic tool or algorithm. Since neither is available here, those methods do not fit. The challenge in stego-only analysis is that the examiner must infer concealed content or detect statistical anomalies using only the suspicious object itself. That makes it one of the more difficult steganalysis situations. In exam logic, whenever the question states that only the suspect media exists and there is no baseline file and no algorithm knowledge, the correct classification is stego-only. That is the option that most accurately matches the evidence conditions described.