Hidden Data – Challenge 2

The second hidden data challenge again related to an image, in this case the Scottish flag below:

In addition to adding data to a file via known metadata, it is also possible to hide information (particularly text) inside a file in a none-obvious way.  This is often done by lying about details of file size.  So, for example, a file format may start with a number which means “The actual image starts at X bytes in and all the stuff before that is metadata.  If we squeeze some extra information in between the metadata and the image and make that number appropriately larger then everything will still work.

To access the hidden data there is a handy Unix command called “strings” which is available on Mac and Linux.  On Windows some additional packages will need to be installed.  So, if we type ‘strings scotland.gif’ we get;

rs% strings scotland.gif
GIF89a
001101110011000000101110001101100011011000110011001100100011001100110110001000000011001000
11001100101110001101100011100000110001001101110011001000110111
N>17B!
HWes
)38@
*A7$
P27L
“4N8
etc etc etc

This long line of ones and noughts is very suspicious.  If we take the first 8 and treat them as binary number we get:

00110111   0x37 = 7
00110000   0x30 = 0
00101110   0x2e = .
00110110   0x36 = 6
00110110   0x36 = 6
00110011   0x33 = 3
00110010   0x32 = 2
00110011   0x33 = 3
00110110   0x33 = 3
00100000  0x20 = ‘ ‘
etc etc

Which turns out to be the coordinates of Hammerfest in Norway which was the answer.

The question also included some hex numbers simply written as text which represented a date.