Which of the following is the BEST way for an IT forensics investigator to detect evidence of steganography? 

Answer options:

A. Compare file hashes between original and modified image files.
B. Identify and analyze emergent properties within a file system`s metadata.
C. Recover deleted files from a suspected hard drive utilizing forensics software.
D. Scan computer operating systems using administrative tools.

A