A 1.47 MB JPG caught my attention today. It looked out of place in the folder. I took a look under the hood. Using Steghide, I found an embedded ref.xml file inside the image. To a regular user, it's just a JPG. It can be shared, uploaded, or passed around without anyone realizing they're helping transport hidden data. This is what secret communication can look like in plain sight. It also got me thinking about Alternate Data Streams (ADS) vs Steganography. Both can be used to hide data inside or alongside another file. The difference is where the data is stored and what forensic artifacts are left behind. 𝐀𝐃𝐒 (𝐍𝐓𝐅𝐒): Data is stored in an alternate stream associated with the file. The primary data stream remains unchanged, and the additional stream isn't normally visible through standard Explorer browsing. 𝐒𝐭𝐞𝐠𝐚𝐧𝐨𝐠𝐫𝐚𝐩𝐡𝐲: Data is embedded into the container itself. Depending on the technique, this can affect the file's structure, metadata, size, or other measurable characteristics. Same objective, different artifacts. Personally, when working with NTFS, I'd lean toward ADS for two reasons. 1. The visible file size stays the same. The hidden data exists in an alternate stream rather than the primary file content. 2. The primary file remains intact. The original data stream isn't modified, allowing the file to continue functioning normally while additional data exists alongside it. That's what makes this interesting from a forensic perspective. A file can look completely ordinary in Explorer while containing data that isn't immediately visible. Simple to implement, easy to overlook. Knowing where to look matters just as much as knowing what to look for.