YanoSecSteganography hides the presence of a message within a carrier, such as an image. A carrier can hold text in a metadata field or data in image samples. These are different storage channels, so inspecting one channel does not inspect every possible method.
A PNG is organized into chunks, typed parts of its structure. The supplied owned-carrier.png has an author-placed tEXt chunk: tEXt is the case-sensitive chunk type for text. Its keyword is Comment and its value is night lamp. This is known construction evidence, not a newly extracted finding.
Before you begin
- Recommended first
- Hex, Base64, and XOR in code, Encoding, hashing, and encryption, Notes: scope, command, result, time, binwalk and carving
- Estimated time
- 15 min reading, 15 min activity. Setup and optional practice may take longer.
- Where you work
- Read the supplied byte tables and authored records in any browser, with paper or a text editor. Preserve original files; inspect copies in any later lab. No scanner, image decoder, capture, memory acquisition or installation is required. Practical tool work remains separate from this reading activity.
- Without a lab
- All evidence needed for the activity appears on this page. Copy it into notes if downloads are unavailable. Read the labeled model and predict each result; a paper trace practises the reasoning while tool operation waits for a lab. Reading needs no JavaScript. Answer checking needs JavaScript and a secure context; saving progress also needs usable browser storage.
After this lesson you can:
- Read the author-placed Comment value night lamp.
- Call the PNG a carrier and the comment a found stored string.
- Limit the result to the text chunk that was inspected.
01Example
Fresh fictional inspection comparison. The actual activity carrier has a different comment value.
Copy A: a text-comment check reads spare lamp.
Supported: this check found that comment value.
Unresolved: methods outside this text check.
The check does not inspect every pixel bit or every hiding channel.02A negative check has a scope
A positive result supports a claim about what the chosen method found. A negative result supports a claim about what that method failed to find, under its assumptions. Neither licenses claims about unchecked channels.
LSB means least significant bit, the bit with the smallest place value in a number. A pixel method might use such bits in image sample values. No LSB inspection was performed here. Merely describing that possibility is not evidence that the supplied carrier uses it.
Locate one declared storage channel and avoid turning a negative check into an unlimited claim.Model. A teaching model drawn by hand. It shows the idea, not real tool output.
Read the full explanation below.
Copy A text-comment check
Copy A: a text-comment check reads spare lamp.This check found spare lamp
The supplied text-comment check explicitly reports that value.
The check is limited to the text-comment channel.
Original fictional teaching evidence
The supplied text-comment check explicitly reports that value. The check is limited to the text-comment channel.
Follow the explanation
- The supplied text-comment check explicitly reports that value. The check is limited to the text-comment channel.
- No pixel-bit or other-channel inspection is supplied. Other methods remain unresolved.
Read every state and value
1. The supplied text-comment check explicitly reports that value. The check is limited to the text-comment channel.
- Evidence selected
- Copy A text-comment check
- Current claim
- found
- Source origins
- Original fictional teaching evidence
2. No pixel-bit or other-channel inspection is supplied. Other methods remain unresolved.
- Evidence selected
- Copy A text-comment check
- Current claim
- all
- Source origins
- Original fictional teaching evidence
03Read the placed comment
Use the construction card as the activity evidence; the carrier is available for separate later inspection.
Label: author-placed PNG text chunk. Not strings(1) output and not exiftool output.
File: owned-carrier.png
Chunk type bytes: 74 45 58 74, the letters tEXt.
Keyword: Comment
Value: night lamp
The serializer wrote that keyword and value. No pixel method was used.
A missing comment on a different file would leave other storage methods unchecked.
- Copy chunk type tEXt, keyword Comment and value night lamp from inspection-card.txt.
- Record the provenance: the course serializer placed the chunk; this card is not strings or ExifTool output.
- Write one supported sentence about this chunk and one unresolved sentence about other storage channels. Do not infer a pixel method from its possibility.
- Stop after these bounded claims. No extractor, outside image or personal photograph is needed.
04Optional challenge
For about ten optional minutes, draw an eight-bit sample value and mark its rightmost bit as the least significant. Write that changing such a bit describes a possible method, not a finding in this carrier. Leave real image extraction for separately scoped practice.
05Fresh cases for the checks
Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.
Carrier card A: independent authored chunkOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.
File: evening-carrier.png. It is the carrier in this fictional card.
Inspected storage: a PNG tEXt chunk, keyword Comment.
Value: dusk compass
The construction card says this text was author-placed. No pixel-bit inspection, strings run or ExifTool run is recorded.
Negative card B: separate inspectionOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.
On another copied image, an inspection of PNG text-comment chunks finds no Comment value.
No pixel-bit channel, appended range or other storage method is inspected.
No evidence says that another channel exists either.
06Explain the evidence and its limit
Optional self-check: make a carrier → inspected channel → observed value → unchecked channels note.
Review it: preserve author-placement provenance, name the exact text storage and avoid turning either a negative check or a possible method into an unsupported universal claim.
07Common mistakes
If the Comment value becomes proof of every hidden message, state which channel the card actually describes.
If no comment is treated as proof that no data is hidden, list one unchecked channel without asserting that it contains data.
If the PNG text chunk is called EXIF output, retain its actual provenance: an author-placed PNG tEXt chunk.
References
- PNG specification, third edition
The PNG specification defines the signature and chunk structure; the supplied carrier uses an authored text chunk.