"luke lurks" too. ;)
There are a few images that have "non-displayable characters" in them.
Pull the keyword field from the metadata & see what it's encoding is??
You know I'm all about "it's in little pieceslike a puzzlethat we have to reassemble" (combine all the little "crumbs" of data into 1 file and that'll give us XYZ proof)
MANY Q pics (PNGs) will reveal a similar NDC string with stegano-red.
zsteg has spit out some interesting stuff, but I'm wearing of short string false positives like we talked about.
We've talked about IMAGE NAMES being important because Q (or the poster) can CHOOSE what they name the image before they upload it. This and the TIMESTAMP (to me) are the most important pieces of the posts (that don't have to do with the content of them–which truly could even just be "cover text" to conceal 'steganographic messages' utilizing timestamps and/or image names).
more to come!