The steganalyst starts by reducing the set of suspect information streams to a subset of most likely altered information streams. Unlike cryptanalysis, where it is evident that intercepted encrypted data contains a message, steganalysis generally starts with several suspect information streams but uncertainty whether any of these contain hidden message. Unless it is possible to fully recover, decrypt and inspect the hidden data, often one has only a suspect information stream and cannot be sure that it is being used for transporting secret information.Some of the suspect signal or file may have noise or irrelevant data encoded into them (which can make analysis very time consuming).The hidden data, if any, may have been encrypted before inserted into the signal or file.

The suspect information stream, such as a signal or a file, may or may not have hidden data encoded into them.

The goal of steganalysis is to identify suspected information streams, determine whether or not they have hidden messages encoded into them, and, if possible, recover the hidden information. It is the art of discovering and rendering useless covert messages. Steganalysis is 'the process of detecting steganography by looking at variances between bit patterns and unusually large file sizes'.

Steganalysis is a relatively new research discipline with few articles appearing before the late-1990s.

Outguess steganography windows