Our trick was zipping the file and renaming it to have the original file extension again. You get some plausible deniability this way (which we ended up never needing to invoke)