Join Us!

Forensic analysis -...
 
Notifications
Clear all

Forensic analysis - HUAWEI mobilephones  

  RSS
Plan_B
(@plan_b)
New Member

Hello members!

I wonder for a long time, if only I have problems with HUAWEI devices roll x

It starts with the fact that the ADB connection ends again and again.

We have some commercial tools to perform an extraktion, but i am never satisfied with the encoding of the data - provided an examination can be done..

When the commercial tools fail, i switch to HuSuite and perform a backup with it. But there is the next problem..

Which software can reliably decode this data from the backup?

i tried MobilEDIT, Oxygen, XRY, UFED ..

So..

HOW do you perform an extraktion of an newer HUAWEI device which cannot be imaged physicaly with an commercial tool?? idea

thanks and
Greez
Pb

Quote
Posted : 13/03/2019 8:07 am
JGilmour
(@jgilmour)
New Member

Local HiSuite backup to an OTG memory stick (which does not get encrypted). The database structure is extremely easy to understand, a simple script can convert it to a filesystem. Process that with an appropriate Physical Analyzer profile. Easy!

ReplyQuote
Posted : 26/03/2019 11:28 am
LeGioN
(@legion)
Member

Hey there!
Might not be of much help but..
We had issues acquiring Huawei phones as well using both Cellebrite and XRY as the development option would randomly deactivate during the process.

This issue however we solved by instead of using the specific phone profile in the tool we use the generic Android profiles that comes with the tool.

Don't ask me why this works for us, it just does p

/LeGioN

ReplyQuote
Posted : 26/03/2019 8:04 pm
passcodeunlock
(@passcodeunlock)
Senior Member

Starting with Android 8.x the Huawei devices are disabling the USB debug mode on adb kill-server commands for some reason. Try setting the ADB access in Charge only mode as well and the issue won't happen.

ReplyQuote
Posted : 27/03/2019 7:00 am
Share: