To somewhat echo what Harlan has stated, I believe you're over-thinking this problem. If he's using a hex editor, it's most likely EXIF data or a sentence, such as, I hope you enjoyed this class.  

To paraphrase IMHO a Forensic genius, eliminate first where it cannot be, and what remains, however impossible, where it is.

Remember an image file format is very specific and structured. for example, if this is a jpeg file, it contains segments, each beginning with a marker. Markers tell you the type of segment, and sometimes the length.

Remove the appropriate, and standard segments, and what you have left is the data you are looking for.

If this method does not work, then look at each segment and look for anomalies within the segments themselves.

Just an idea.