considering a small padding (front and end) which I had previously missed, the inserted contents are all exactly the same length and are all inserted at position file-len/2.
with that we examined all images on the system to see if we could find hex encoded ascii strings at that location and recovered what we think is the rest of the content.
the naming convention of the files is definitely intended to show a sequence for rebuilding the content.
Good ) , you have now convinced me that it represents a naive attempt at steganography (intentional).
1/2 file size + fixed length are a simple enough "decoding algorithm", fully compatible with "encode some text and put it within files, without considering that the file is not anymore a "standard" format" approach.
jaclaz
Good ) , you have now convinced me that it represents a naive attempt at steganography (intentional).
1/2 file size + fixed length are a simple enough "decoding algorithm", fully compatible with "encode some text and put it within files, without considering that the file is not anymore a "standard" format" approach.jaclaz
it was your previous comment that had me go back and check the insertion position and then realise that we had missed the padding. after that it all fell together pretty simply.
thanks!