Steganography and metadata: hidden information in files

In short: Steganography hides messages inconspicuously in images, audio or text; metadata such as EXIF, by contrast, often unintentionally reveals location, device and time. Both matter for privacy and forensics.

In more detail: Cryptography makes content unreadable, steganography conceals that a message exists at all. Metadata is additional information in files that one often does not notice.

In Depth

Steganography (principle)

• LSB (least significant bit): in images you change the least significant bits of colour values, which the eye hardly sees; each pixel can carry a few bits of a secret message. Example: red value 10110100 → replace the last bit with a message bit.
• Also in audio (echo/phase), video, text (spaces, zero-width characters), file structures (appending after EOF), network packets.
• Watermarks (visible/invisible) for copyright protection and AI image labelling (C2PA).
• Limits: compression (JPEG) destroys LSB data; statistical analysis (steganalysis) detects anomalies; without additional encryption the message is readable once found.
• Use: privacy in repressive countries, but also by malware to hide commands; a popular category in CTFs.

Metadata: what files reveal

• Photos (EXIF): GPS coordinates, capture time, camera model, settings, possibly serial number. Photos posted online can reveal the home location.
• Documents (Word, PDF): author, company, edit history, comments, file paths, software version.
• PDF/Office attachments: hidden layers, redacted text only painted over (content remains!).
• Audio/video: tags, device, location.
• Printers: tracking dots (machine identification code) on printouts.
• Social media often strip EXIF, but not all platforms/messengers with original files.

Removing metadata and privacy

• Phone: camera location off, remove location when sharing (iOS/Android share dialog).
• Windows: Properties → Details → “Remove properties and personal information”; macOS/Linux: exiftool -all= image.jpg, mat2, ImageMagick -strip.
• Documents: “Inspect document” (Office), redact PDFs properly (redaction function), export as image/new.
• Before publishing on the website/in the shop: product photos without GPS (see image optimisation).
• GDPR: metadata can be personal data (author, location).
• Journalism/whistleblowers: metadata hygiene is mandatory (MAT2, Tails).

Forensics and learning

• Tools: exiftool, binwalk, strings, steghide, zsteg, Stegsolve, Audacity (spectrogram), CyberChef, hex editors.
• Procedure in CTF: file type (file), metadata, strings, appended data, colour channels/LSB, spectrogram.
• Legal: examine only your own files/practice tasks; malware analysis in an isolated VM.
• Related: cryptography basics, forensics, privacy, image formats, AI labelling (watermarks), fingerprinting.

See also: Optimising images on the web, Browser fingerprinting, CTF and legal practice platforms