CHAPTER IV

DESIGN & IMPLEMENTATION

4.0 DESIGN DOCUMENTATION
The design document describes the requirements and architecture in
developing E-evidence System.
4.1 INTRODUCTION
Chapter 4 contains detailed description of the system design. It discusses the
hierarchy of the system which clarify how the system looks, works and how
its composed by looking deeply into its modules and component including
system diagrams that consists of block diagrams, sequence diagram and the
flow chart. So, user will know and understand the flow of the system. At this
chapter, it will describe the implementation of the evaluation that been
conducted timely manner. Many issues pose by mobile phones need to be
address in order to maintain the integrity and also the reliability of evidence . E-

evidence System is a standalone system that consists of security and data

integrity tool useful to monitoring and detecting the changes of phone
message (sms). E-evidence System will store the original information of
message that been extracted from the phone and the hash value of the
message. Next, the same message from the same hand phone has been
deleted from the same hand phone, will be extracted back and being
converted into hash value also. The two hash data will be compared and the
changes will be detected in the system. This comparison method involves
calculating a known cryptographic checksum of the messages original
baseline and comparing with the calculated checksum of the current
message. In this system,MD5 algorithm has been used to develop the Eevidence System. MD5 hashes are used to verify that a message has not
changed. This is useful, even crucial, in all kinds of situations where data
integrity is important. Although MD5 is not a very secure hashing algorithm,
since it is vulnerable to collision SHA1 is a much more secure hashing

algorithm, although its principles are somewhat based on those of MD5. For
general use, MD5 are very efficient and most likely attacks, it is still widely
used to check the electronic evidence integrity.

4.2 PROJECT REQUIREMENTS

In this section we discuss the detail project requirements in the form of flow
chart. In addition, this section provides the requirement needed to build and
integrate the hardware components, code and integrate the software
modules, and interconnect the hardware and software segments into a
functional product.

Prepare and set up the hardware requirement

Prepare and install the software requirement

Prepared and setup control data

Prepared and setup controlled data

Design the algorithm of system

Design the interface of the system

Develop the system

4.3 PROJECT IMPLEMENTATION DESIGN

In this section, we discuss the implementation design of the E-evidence
System. This design is presented in the form of flow chart. E-evidence is
divided into two parts which are Database Initialization and Integrity
Verification. Both parts will describe briefly in this section.
4.3.1 Database Initialization of E-evidence.
Database Initialization part focus on the four important functions which are:
1. Extracting message
2. Generate Original Hash Value
3. Save Data into Database
4. View Data from Database

The implementation of testing has been conducted at this stage. In this we

are using Samsung hand phone to extract the message to be used. The
reason to selected this phone because of their reputation of supporting many
different forensic recovery tools. The forensic tools that are being used to
extracted the data is MOBILedit!.

4.3.2 Procedure of extracting data from memory

Data can be extracted from the different location in the mobile phone. In this
part, evidences of each mobile phone are first extracted and recovered from
its internal memory using mobile forensic tool. However, only data from the
hand hone are beyond the scope of this research. Figure 4.1 (a) and 4.1(b)
show the process of extracting data from hand phone.

Figure 4.1(a)

Figure 4.1(b)

Extract baseline
data using
mobile forensic
tool

Export actual data

needed (original
message)to excel
file

Delete several
message from
phone

Export deleted
message to excel
file

Recover deleted
message using
mobile forensic
tool