DEVELOPING A HYBRID LOG-FILE–BASED COVERT CHANNEL FOR SECURE DIGITAL FORENSIC DOCUMENT TRANSMISSION

Security is a fundamental requirement in Digital Forensic (DF) systems, given the increasing number and sophistication of cyber threats. Among the major challenges in DF is ensuring the secure transmission of Digital Forensic Documents (DFDs) between authorized entities. This paper proposes a hybrid covert channel designed to enhance the confidentiality and un-detectability of DFD transfers by exploiting runtime errors and system log files. The proposed method leverages the Digital Forensic Legal Affairs Server (DFLAS) log file, where original DFDs embedded with covert data are written and subsequently transmitted through a concealed communication channel. The original files remain preserved in the server’s log file after transmission, ensuring both integrity and traceability. To achieve robust security, the hybrid covert channel integrates randomization, encryption, and controlled packet delay, collectively reinforcing confidentiality and resistance to detection. The performance evaluation focuses on analyzing time transmission and bandwidth efficiency during exchanging the DFDs. Experimental results show thatthe proposed channel achieves high efficiency in covert data transmission, with transmission time and throughput comparable to conventional channels. Additionally, it provides a high level of confidentiality through the use of encryption and randomization techniques. The results show that transferring a 112 MB file requires approximately 4000 ms on the DFLAS side, demonstrating competitive performance compared with existing approaches. The results further indicate that the extraction capacity rate varies according to the applied delay intervals while maintaining practical throughput levels suitable for DF real-world deployment. The achieved throughput of 29.12 MB/sec confirms the method’s practicality. The proposed covert channel provides confidentiality, plausibility, and undetectability, making it a promising approach for secure and efficient transmission of digital forensic documents.