


There are two fairly large fields, marked sign and chtb, that are unique to each copy of a given track. There are also several other places where copies of the same song vary by three or four bytes (they can be readily observed with a program like vbindiff). It should be assumed that a file is potentially identifying unless all of these fields have been overwritten.

Lastly, Privatunes 0.9 just overwrites the name and email address using ASCII spaces (0x20). This means that the length of these two fields can still be seen after the file has been modified. For complete anonymization, these lengths should be made unreadable.