Detection of items stored in a computer system

An apparatus comprising a storage device for storing computer files, wherein the apparatus is configured to:

• obtain a steganographic signature by reading a partial section of executable code of a program, wherein the program includes software calls that introduce steganographic items into a computer file;
• identify one or more computer files, other than the program, comprising software code;
• obtain one or more test signatures by reading partial sections of the software code;
• compare the steganographic signature with the one or more test signatures to identify when a match with the steganographic signature is found;
• and
• in response to identifying when the match is found, display a listing of which of the one or more computer files has been modified by the program.

A non-transitory computer readable medium having stored therein computer readable instructions that, in response to execution by a system, cause the system to perform operations comprising:

• identifying one or more computer files comprising software code;
• obtaining one or more test signatures by reading partial sections of the software code;
• obtaining a steganographic signature by reading executable code comprising part of a steganographic program including software calls that introduce steganographic items into the one or more computer files;
• comparing the steganographic signature with the one or more test signatures, wherein the steganographic program is excluded from said comparing;
• and
• in response to said comparing, displaying a listing of which of the one or more computer files comprises software code that has been modified by the steganographic program.