image/svg+xml
hiddenvolumedata– ourpayload
outer volume data (defunct)
hidden vol.header
fake data
'mdat'
header ('ftyp')
media header('moov')
outervolumeheader
hidden vol.header
outer volume data
hiddenvolumedata
vol. headerbackups
size
size ‒ 128k
128k
64k
0
header ('ftyp')
media data('mdat')
media header('moov')
QuickTimeor MP4 file
TrueCryptcontainer
QuickTime/TrueCrypthybrid file
realmediadata(original'mdat')
media data blob