What a hidden volume actually protects you from

There are two separate ideas stacked on top of each other in a product like Subfile, and it helps to pull them apart before deciding whether either one is useful to you. The first is encryption: your files are unreadable without the password. The second is concealment: the encrypted data lives inside a file that looks and behaves like an ordinary video, photo or audio recording. Encryption is the part that is mathematically strong. Concealment is the part that is contextual, and contextual things fail in ways that maths does not.

Most of the confusion around steganographic containers comes from treating the second property as if it inherited the guarantees of the first. It does not. Concealment is a social and forensic property, not a cryptographic one, and it is worth being precise about which threats it moves the needle on.

What concealment genuinely helps with

The realistic threat for most people is not a state adversary. It is someone with brief, opportunistic access to a machine or a drive, and no particular reason to dig. Concealment works well against that.

• A shared or borrowed Mac. Someone sits down at a family machine, opens Finder, and scans the file names. An encrypted disk image called private.dmg is an invitation. A 6 GB video of a trip to Iceland is not.
• Backups and sync folders. A vault inside a media file rides along in Time Machine, on a USB stick, or in a file-level sync folder without announcing that anything is being protected.
• Casual snooping by people who know you. This is the most common form of real-world privacy loss, and it is almost always low-effort. The absence of an obvious target is usually enough.
• Deniability by boredom. Not the courtroom sense of the word — just the fact that nobody asks about the file, so you never have to explain it, refuse to open it, or invent a reason.

That last one is the honest version of what people mean when they say plausible deniability. You are not defeating an examiner. You are avoiding a conversation.

What it does not do

A hidden volume is unremarkable, not undetectable. Those are different words on purpose.

• It does not defeat forensic analysis. Encrypted data is high-entropy data, and high-entropy data sitting in a region of a file where a codec would not put it is a recognisable pattern. Someone who knows what they are looking for, and who has the file and the time, can find it.
• It does not protect a mounted vault. Once you unlock it, the volume is a normal drive on a running machine. Anything with access to your session — an application you granted disk access to, a screen recorder, someone standing behind you — sees plaintext, exactly as it would with any other encrypted disk.
• It does not survive re-encoding. Recompressing a photo, transcoding a video or repacking an archive rewrites the bytes the vault lives in. Some services do this on upload as a matter of course, and they do not tell you.
• It does not fix a weak password. The strongest cipher in the world is a formality if the key material comes from a guessable phrase. Concealment does not add entropy.
• It does not stop coercion. If someone can compel you to hand over a password, the fact that the container looked like a holiday video only matters if they never learn the container exists.

Where people actually get caught out

In practice, the container is rarely the weak link. The context around it is. A vault mounted at /Volumes/PRIVATE shows up in the Finder sidebar, in the sidebars of any file picker, and in the recent-items lists of every app that touched it. Spotlight may have indexed what you opened. A document you edited from the vault might have written an autosave or a preview thumbnail somewhere outside it. None of that is a flaw in the cipher; it is the operating system doing its job.

The carrier file is also a story that has to hold together. A 40 GB photo is not a photo. A video that appears in a folder of documents, with a name that matches nothing else around it, draws exactly the attention you were trying to avoid. Concealment is a matter of fitting in, and fitting in is your job, not the software's.

How to reason about it

The sensible framing is layered. Encryption is the load-bearing wall: it decides whether the data can be read at all, and with well-reviewed primitives and a strong password, the answer is no. Concealment is a second, softer layer that changes how likely anyone is to try in the first place. It reduces the number of encounters that turn into an attempt. It does not change the outcome once an attempt begins.

That is a real benefit, and it is worth having, as long as you buy it with clear eyes. If your threat model involves someone who has both a reason to look and the skill to look properly, plan as if the vault is visible and let the encryption carry the weight. If your threat model is the far more ordinary one — a shared machine, a repair shop, a partner, a housemate, a colleague, a lost laptop — then not being interesting is a genuinely effective defence, and it is one that stronger cryptography alone cannot give you.