File-Structure Steganography

A subject conceals data within unused, ignored, optional, or non-rendered areas of a file or container so that the carrier continues to function normally while the hidden payload remains outside the content presented to the viewer.

The technique may use padding, reserved fields, unused headers, slack areas, archive comments, trailing data, application-specific metadata, or other structures retained during transfer but not normally displayed or processed. Examples include placing data after the logical end of a file, storing content in unused container fields, or exploiting differences between how applications and security tools interpret the same format.

This behavior may frustrate investigation because the visible content appears benign and the concealed data may only be identified through structural parsing, hexadecimal examination, file carving, or validation against the relevant file-format specification.