Steganographic Techniques for Hiding Data in SWF Files

  • Mark-Anthony Fouche
  • Martin Olivier
Conference paper
Part of the IFIP Advances in Information and Communication Technology book series (IFIPAICT, volume 361)


Small Web Format (SWF) or Flash files are widely used on the Internet to provide Rich Internet Applications (RIAs). This makes SWF files an excellent candidate for disseminating hidden data. However, digital forensic investigators are unable to detect and extract the hidden data because limited information is available about the techniques used to hide data in SWF files. This paper investigates several data insertion techniques for hiding data in SWF files. The techniques include appending data to an SWF file, adding an extra Metadata tag, creating a custom Definition tag, and replacing fill bits with hidden data. Experimental results obtained with a simple SWF (version 10) file are used to evaluate the effectiveness of the data hiding techniques and identify the artifacts that remain.


Steganography Small Web Format Flash files 


  1. 1.
    Adobe Systems, SWF File Format Specification (Version 10), San Jose, California (, 2008.Google Scholar
  2. 2.
    Adobe Systems, Adobe Flash Video File Format Specification (Version 10.1), San Jose, California (, 2010.Google Scholar
  3. 3.
    D. Artz, Digital steganography: Hiding data within data, IEEE Internet Computing, vol. 5(3), pp. 75–80, 2001.CrossRefGoogle Scholar
  4. 4.
    F. Cohen, Digital Forensic Evidence Examination, Fred Cohen and Associates, Livermore, California, 2010.Google Scholar
  5. 5.
    E. Dallaway, Steganography is key ingredient to anti-forensics, Infosecurity Magazine, vol. 5(8), p. 11, 2008.Google Scholar
  6. 6.
    J. Davis, J. MacLean and D. Dampier, Methods of information hiding and detection in file systems, Proceedings of the Fifth International Workshop on Systematic Approaches to Digital Forensic Engineering, pp. 66–69, 2010.CrossRefGoogle Scholar
  7. 7.
    G. Kessler, An overview of steganography for the computer forensics examiner, Forensic Science Communications, vol. 6(3), 2004.Google Scholar
  8. 8.
    A. Martini, A. Zaharis and C. Ilioudis, Data hiding in the SWF format and spreading through social network services, Proceedings of the Fourth International Workshop on Digital Forensics and Incident Analysis, pp. 105–115, 2009.Google Scholar
  9. 9.
    A. Mozo, M. Obien, C. Rigor, D. Rayel, K. Chua and G. Tangonan, Video steganography using flash video, Proceedings of the IEEE Instrumentation and Measurement Technology Conference, pp. 822–827, 2009.Google Scholar
  10. 10.
    G. Tadiparthi and T. Sueyoshi, A novel steganographic algorithm using animations as cover, Decision Support Systems, vol. 45(4), pp. 937–948, 2008.CrossRefGoogle Scholar
  11. 11.
    B. Wilson, MAMA: Key findings ( ma-key-findings), 2008.Google Scholar
  12. 12.
    X. Zhang and X. Zhang, Information hiding algorithm based on flash animation, Computer Engineering, vol. 36(1), pp. 181–183, 2010.Google Scholar

Copyright information

© IFIP International Federation for Information Processing 2011

Authors and Affiliations

  • Mark-Anthony Fouche
    • 1
  • Martin Olivier
    • 1
  1. 1.University of PretoriaPretoriaSouth Africa

Personalised recommendations