Which of the following is the BEST way for an IT forensics investigator to detect evidence of steganography?

A. Compare file hashes between original and modified image files.
B. Identify and analyze emergent properties within a file system's metadata.
C. Recover deleted files from a suspected hard drive utilizing forensics software.
D. Scan computer operating systems using administrative tools.