Huawei is the sixth largest Smartphone manufacturing company in the world, with a 4% smartphone market share as of July 2023. Their major market is in China, followed by the EMEA region.
Due to Huawei devices’ global popularity, it is important to understand Huawei forensics – along with the extraction methods and tools that can help with your investigation. Data extraction from a Huawei device can involve various methods depending on the type of data you are trying to access.
Direct Huawei Extraction
Oxygen Forensic® Detective offers various methods for both passcode-locked and unlocked Huawei devices.
The extraction techniques for passcode-protected devices vary according to the chipset used in Huawei devices. The chipsets may be Kirin, Mediatek, or Qualcomm, all of which are supported by our software:
- The Huawei Kirin method supports devices running Android OS 9-10 and having File-Based Encryption (FBE). The following Kirin chipsets are supported: 985, 980, 970, 820, 710, 710F, 659, 810, 960, 990, and 990 5G . To perform an extraction from these devices, test points must be used to short out capacitor pins on the phone’s motherboard.
Learn more about Huawei Test Points →
- The MTK Android method covers over 20 Huawei devices with Android OS 9-10 and File-Based Encryption (FBE). The supported chipsets are MT6765, MT6762, and MT6761.
- The Huawei Qualcomm EDL method works with Huawei devices running Android OS 7 or higher and using File-Based Encryption (FBE). The following Qualcomm chipsets are supported: MSM8917, MSM8937, and MSM8940.
For unlocked Huawei devices, there are several other methods available:
- Full File System extraction, which is compatible with Android devices with the Security Patch Level (SPL) no later than October 2022. This method allows to get full file system and Android Kestore keys that can be used for app database decryption.
- APK Downgrade, which supports devices with Android OS 5-13. This method allows to extract the 60 most popular apps using the temporary APK downgrade procedure.
- Android Agent, which is compatible with devices with Android OS 4.1-14. This approach allows extraction of basic data as well as applications. Screenshots and video recordings can also be recorded with this utility.
HiSuite Backups
Huawei HiSuite is the official software provided by Huawei that allows you to connect your Huawei device to a computer. It provides features for data backup, restoration, and management. You can import a HiSuite backup and extract data such as contacts, messages, and media files.
Learn more about HiSuite backups →
Huawei Cloud Data
Cloud is an alternative method of data extraction from Huawei device.
Oxygen Forensic® Cloud Extractor offers the following services:
- Huawei Cloud Backup. If the user has enabled Huawei Cloud backup, you may be able to access their data by logging into their Huawei Cloud account via username/password, token, phone number, or scanning a QR code.
- Huawei Cloud Data. Unlike a backup, it might store actual data. The authorization is done the same way as for Huawei Cloud Backups.
- Huawei Health. Huawei Health is a pre-installed app available on Huawei devices that tracks the user’s movements and activity, mapping routes, monitoring heartbeat, and sleep data. The app can also be installed on other devices besides Huawei. The authorization methods are the same, as described above.
Huawei PrivateSpace
Besides all of the available data, our software can decrypt Huawei PrivateSpace. This is a special program feature that creates a private storage space on a Huawei or Honor smartphone. This storage space is completely separate from the device’s main storage and is configured to only allow access via fingerprint ID or password. The PrivateSpace password must be different from that of the main phone space. Users have the ability to store photos, videos, audio, and contacts. Files and application data can be stored.
When the Huawei Kirin method is used, Oxygen Forensic® Detective automatically detects Huawei PrivaSpace and allows to brute force the passcode to decrypt it.
Learn more about Huawei PrivateSpace →
Digital Forensic Tools
Oxygen Forensics specializes in digital forensic software solutions. It provides tools and software for law enforcement, private investigators, enterprises, and government organizations to extract, analyze, and recover digital evidence from various devices, including mobile phones, computers, cloud services, and more.
Oxygen Forensics offers a range of products and services that are crucial in criminal and legal investigations, corporate incidents, and other situations where digital evidence plays a role.
Oxygen Forensic® Detective
Oxygen Forensics’ flagship solution, Oxygen Forensic® Detective, was built to support investigators throughout the entire investigative process. It can extract data quickly and completely from the full digital landscape and facilitate deep analysis and flexible reporting in a single platform. It extracts data and artifacts from various sources with capabilities for mobile, cloud, and computer forensic investigations.