±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 1 Overall: 35755
New Yesterday: 5 Visitors: 131

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Forensic analysis - HUAWEI mobilephones

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

Plan_B
Member
 

Forensic analysis - HUAWEI mobilephones

Post Posted: Mar 13, 19 09:07

Hello members!

I wonder for a long time, if only I have problems with HUAWEI devices Rolling Eyes Mad

It starts with the fact that the ADB connection ends again and again.

We have some commercial tools to perform an extraktion, but i am never satisfied with the encoding of the data - provided an examination can be done..

When the commercial tools fail, i switch to HuSuite and perform a backup with it. But there is the next problem..

Which software can reliably decode this data from the backup?

i tried MobilEDIT, Oxygen, XRY, UFED ..


So..

HOW do you perform an extraktion of an newer HUAWEI device which cannot be imaged physicaly with an commercial tool?? Idea

thanks and
Greez
Pb  
 
  

JGilmour
Newbie
 

Re: Forensic analysis - HUAWEI mobilephones

Post Posted: Mar 26, 19 12:28

Local HiSuite backup to an OTG memory stick (which does not get encrypted). The database structure is extremely easy to understand, a simple script can convert it to a filesystem. Process that with an appropriate Physical Analyzer profile. Easy!  
 
  

LeGioN
Member
 

Re: Forensic analysis - HUAWEI mobilephones

Post Posted: Mar 26, 19 21:04

Hey there!
Might not be of much help but..
We had issues acquiring Huawei phones as well using both Cellebrite and XRY as the development option would randomly deactivate during the process.

This issue however we solved by instead of using the specific phone profile in the tool we use the generic Android profiles that comes with the tool.

Don't ask me why this works for us, it just does Razz

/LeGioN  
 
  

passcodeunlock
Senior Member
 

Re: Forensic analysis - HUAWEI mobilephones

Post Posted: Mar 27, 19 08:00

Starting with Android 8.x the Huawei devices are disabling the USB debug mode on adb kill-server commands for some reason. Try setting the ADB access in Charge only mode as well and the issue won't happen.
_________________
Apple passcode unlock + decrypted filesystem dump, Android user locks unlock + physical dump with decrypted userdata partition. We provide our services world-wide, but we reserve the right for choosing which tasks we take and which we deny! 
 

Page 1 of 1