Detection of items stored in a computer system such as computer code, data or information includes obtaining signatures characteristic of programs of interest such as steganographic programs. A signature is obtained by reading code from a program of interest. The code may consist of the first 500 bytes from a .DLL file taken from the programs' core steganographic kernel. This code is then the signature. The computer system compares the signature with files it holds, other than files on a prearranged exclusion list. If a signature is found to match data in a file, the filename, the finding of steganography in it, the file location and the matched signature are recorded by the computer system for output to its user.