The tools currently used for steganography embedding are discussed and demonstrated. Students will use these tools, and learn how to detect their presence on suspect systems during post-mortem analysis. This allows a refined investigation by determining the embedding application used. Participants will also be trained in the use of specialized steganography detection and analysis tools in order to confirm steganography presence.