The file audit covers all 75 archived page files. Two early files contain appended material that reproduces existing puzzle content. None of the 58 LP2 files has trailing bytes, a JPEG comment, EXIF/XMP metadata or an embedded thumbnail detected by these checks. No new plaintext was established.
Steganography testing has a significant limitation: OutGuess crashed on 41 files, including 39 LP2 pages. Those are unresolved tool failures, not negative extractions. Steghide completed its empty-passphrase checks on all 75 files without extracting a payload.
1. Source bytes and JPEG structure
We fetched archive files 00.jpg through 74.jpg from this fixed repository revision. All 37 previously retained JPEGs matched the newly fetched copies byte for byte. The 75-file manifest records individual SHA-256 hashes and pinned URLs. These are archived copies; agreement does not independently authenticate the original distribution.
Every primary image decodes as a 2400 × 3600 baseline JPEG, and all 75 pass jpeginfo's decoding check. The parser walks segment lengths and entropy-coded scans before recognizing the JPEG end marker. It does not mistake an end-marker byte sequence inside a comment for the end of the image.
| File | Bytes after the first JPEG | Identification |
|---|---|---|
| 05.jpg | 336,713 | A 360-byte middle section followed by the exact 336,353-byte first JPEG in reverse byte order |
| 10.jpg | 3,486,295 | Three complete JPEGs, byte-identical to 11.jpg, 12.jpg and 13.jpg, in that order |
| Other 73 files | 0 | No bytes after their parsed JPEG end |
For 05.jpg, stripping whitespace from the middle section, reversing its hexadecimal characters, and decoding the hex yields this known square:
| 272 | 138 | 341 | 131 | 151 |
| 366 | 199 | 130 | 320 | 18 |
| 226 | 245 | 91 | 245 | 226 |
| 18 | 320 | 130 | 199 | 366 |
| 151 | 131 | 341 | 138 | 272 |
This is a real byte-reversal construction, but it reproduces the square already recorded for that solved page. It does not justify reversing arbitrary unsolved-page text.
No file has a JPEG COM segment or APP1 segment. ExifTool's independent read reports no EXIF, XMP, IPTC, thumbnail or preview tags; JFIF thumbnail dimensions are zero throughout. This is a structural inventory, not a claim that compressed image coefficients cannot carry data.
2. Steganography controls and extraction
Tools: OutGuess 0.4, Steghide 0.5.1, ExifTool 12.76 and jpeginfo 1.7.1. Package URLs and hashes are in the tool manifest. Tool behavior and options were checked against their packaged manuals; the OutGuess project documents its supported image formats and key-based embedding.
A deterministic synthetic JPEG cover and a 101-byte message were used for four embedding-and-recovery controls: default and named-key OutGuess, plus empty and named-passphrase Steghide. All four recovered the exact original bytes. Both tools also checked the untouched cover without recovering that message. The first attempted control payload was too large for OutGuess's reported correctable capacity, so the payload was reduced before the successful controls and archive scan.
The archive scan used only these fixed settings:
- OutGuess:
outguess -r input.jpg output.bin, no supplied key, no error correction. - Steghide:
steghide extract -sf input.jpg -xf output.bin -p '' -f.
No dictionary search, alternate-key search, ECC scan or general-purpose steganalysis was performed.
| OutGuess 0.4 outcome | LP1, 17 files | LP2, 58 files |
|---|---|---|
| Returned output and exit status 0 | 13 | 16 |
| Reported failure, exit status 1 | 2 | 3 |
| Crashed with SIGFPE | 2 | 39 |
Nine LP1 outputs are readable historical puzzle messages: 00–03, 08 and 10–13. Eight match complete messages in the archived LP account after whitespace normalization. The 10.jpg extraction carries the same instruction family but a border numeral of 3 where that archive's page-10 excerpt has 1, with a different signature. We record the discrepancy rather than claiming an exact match. We did not independently verify PGP signatures in this session.
The other four successful LP1 outputs and all 16 successful LP2 outputs are unvalidated binary data. A successful exit and a nonempty output file do not demonstrate an embedded message. In particular, all 16 LP2 outputs have the same reported length, 58,152 bytes; that length is not treated as a decoded clue.
Steghide reported that it could not extract data with the empty passphrase on every file. This does not exclude another passphrase or another method.
Unresolved OutGuess failure
OutGuess 0.2 recovered both planted OutGuess controls exactly, but also crashed on the representative failing file 18.jpg, LP2 page 1. The legacy check records this result. The remaining crashes were not rerun with 0.2. We have not identified or repaired the crash mechanism, and cannot count those files as successfully tested for absent OutGuess content.
3. Cross-page comparison
| Property | LP1 | LP2 |
|---|---|---|
| ICC color profile | Absent in all 17 | One identical 2,576-byte profile in all 58 |
| JPEG color mode | 17 RGB | 35 RGB, 23 grayscale |
| Quantization-table signatures | Three combinations | Two combinations, separated exactly by color mode |
| Appended material | Two files | None |
The shared LP2 profile describes itself as Artifex Software sRGB ICC Profile. Even the grayscale images contain the identical profile. Its date field is all zeroes, so it supplies no useful creation date. All LP2 pages also share the same first quantization table; the color images have an additional chroma table. These are consistent with a common export process, but do not identify an author, operating system or cipher.
The tree page, archive 49.jpg / LP2 page 32, shares the profile and table signature of the other color LP2 pages. It has no appended bytes or unique metadata in this comparison. Huffman-table bytes differ across LP2 images; that alone is expected to be compatible with content-dependent compression and is not evidence of a hidden alphabet.
Reproduction and evidence
- Main audit script, per-file results and control logs, and independent metadata read.
- Follow-up script and aggregate counts and archive comparisons.
- Synthetic cover, known payload, default OutGuess control, keyed OutGuess control, empty-passphrase Steghide control, and keyed Steghide control. The named control key is
session37-control; none of these synthetic files is historical puzzle material.
The main script takes an image directory, an extracted tools root and an output directory. It validates source hashes before and after analysis, and stops if a planted-message control fails. Parser controls cover a false end marker inside a comment, a real trailer, concatenated JPEGs and a progressive multi-scan JPEG. It never executes extracted content or rewrites source JPEGs.
Next useful step: diagnose the OutGuess crash on one reproducible file, then apply a validated fix to the affected pages. The structure audit supplies no new LP2 payload; the extraction failure prevents an all-clear conclusion about steganography.