Discover hidden data in common format files

There’re many reasons to hide data in files and the data type varies. This article will discuss how to reveal hidden data rather than how to hide data.

Powerpoint

1. Comment

2. Presenter’s notes

I haven't seen many examples of hiding data in ppt files and the
above two are easy to spot.

Excel

1.Hide rows or columns

This is a very easy way to hide information. You can find the row or column index is not continuous.

Screen Shot 2019-12-06 at 11.46.32 pm

2. Hide sheet

Under this circumstance, click ‘unhide’. If you can’t click ‘unhide’, that’s probably ‘very hide‘. Try checking the properties in VBA. Right click and choose ‘View code’. Clearly, the value of attribute Visible is ‘0 – xlSheetHidden’. So you can change the property here or run VBA code.

Screen Shot 2019-12-06 at 11.39.26 pm.png

In some cases, the file is under protection and needs password to have the permit to change the attribute. You can use 7zip to open it.

3. Broken file

7zip can even open such a file. When you archive it, you can see the content of it.

Word

1.Embedded file

This is hard to find where it is. I use LibreOffice to solve such kind of problems. The following screenshot shows that there’s one OLE (Object Linking and Embedding) in the file which indicates the place for the embedded object.

Screen Shot 2019-12-10 at 1.55.31 pm.png

2. Odt (Open document text) file

This is not technically word file but you can open it with Word. The file has 6 pictures in it and LibreOffice also proves this. But if we open the file with 7 zip, it shows the 7th hidden picture.

Screen Shot 2019-12-10 at 2.10.45 pm.png

Pdf

1.Information is blocked by a black stripe

Screen Shot 2019-12-10 at 1.48.02 pm.png

Though you cannot see it, you can select it and copy, paste to somewhere else. Or use LibreOffice to remove the blocks.

2. Two pictures at the same place and one is covered by the other

Screen Shot 2019-12-10 at 1.30.20 pmScreen Shot 2019-12-10 at 1.32.27 pm.png

This is a clever move. But with the help of LibreOffice, you can move around the picture and find the secret.

There are some files that you cannot open. This is probably because the extension doesn’t really match the file format. The best way is to examine the file signature viewing the hex data. Speaking of this, you can check my other blogs about this topic. But you can always have a guess. For example, try changing the extension to png or pdf or txt, etc. To find the hidden data, you need to be careful to notice uncommon things. I personally prefer to use 7zip and LibreOffice.This article didn’t cover stenography, which requires using some advanced tools.

Leave a comment