Huawei backup

This option potentially allows users to extract additional data from Huawei devices, that might not be obtained using MOBILedit Forensic and a live-connected device.

The reason for this is that some of the proprietory Huawei apps may be sandboxed and might not be accessible when extracting via a logical extraction. However, data might be exported to a Huawei HiSuite backup.

You need to create and save a backup of the Huawei device using the HiSuite software provided by Huawei. After which, you can then import the HiSuite backup into MOBILedit Forensic to extract and analyze the data from the backup.

Only the backup created using the Windows HiSuite application can be imported into MOBILedit Forensic.

HiSuite

Download the latest HiSuite and install it on your PC.

Open HiSuite and connect your phone via USB cable. HiSuite will offer to install a suitable version of SW that is compatible with the connected device.

A pop-up window will appear asking you start HiSuite on the device to view a code. A number of permission requests will appear on the device and, all of these should be allowed.

Enter the code displayed on the device into the HiSuite SW running on your workstation.

Click on the “Back Up” button and you will be asked to confirm the request on the mobile device. Once allowed, authorization is granted, then click “OK”.

You may also be asked to install a new HiSuite application on the device to be able to use the backup feature.

HiSuite will display a summary of data that can be backed up and you should select all that you wish to backup. It is best to select all.

Then select “Back Up” and you are forced to set a password which will encrypt the backup.

On-screen, you may see a notification regarding certain apps that cannot be backed up e.g. WeChat and QQ. These apps must be backed up using the backup tools built in to those apps.

Once the password is set, the backup will start and when the backup is complete it is ready for import into MOBILedit Forensic.

MOBILedit Forensic

MOBILedit Forensic cannot run if HiSuite software is also running on the same workstation. Upon startup, MOBILedit Forensic will automatically detect if HiSuite is running and ask if you would like to stop the program. Confirm this in the Windows notification.

To import the Huawei backup, open MOBILedit Forensic, click on “Import data” and choose “Huawei backup folder”.

Choose the folder you've saved your backup in and the backup will be loaded and initialized.

You will be prompted to enter the password you created for the Huawei backup.

Once loaded and decrypted, you can continue with a logical extraction or return to the connection screen.

There may be a difference in the number of contacts shown in a Huawei backup compared to the contacts in the MOBILedit Forensic output report. This is because HiSuite only takes the data for locally stored phonebook contacts and ignores cloud or app contacts under that category. MOBILedit Forensic looks at all contacts accross the whole device.

Types of data in a HiSuite backup

A HiSuite backup, which is Huawei's official desktop management software, includes a wide range of data from your Huawei device. The types of data typically backed up with HiSuite are:

Contacts: All your contacts, including phone numbers, emails, and addresses.
Messages: SMS and MMS.
Call Logs: Record of incoming, outgoing, and missed calls.
Photos and Videos: All media files stored on your device.
Music and Audio Files: Music, ringtones, and other audio files.
Documents and Files: Any other files stored on your device's internal storage.
Apps and App Data: Installed apps and their data, including settings and preferences. Note that some apps might not back up all data due to security restrictions.
Settings: Device settings, including Wi-Fi passwords, wallpaper, and home screen layout.
Calendars: Calendar events and schedules.
Emails: Email accounts and possibly the email data itself, depending on how they are stored on the device.
Notes: Notes and memos stored on the device.
Browser Data: Bookmarks, history, and possibly saved passwords.
Alarms and Clock Settings: Alarm settings and world clock entries.
Connection Settings: Bluetooth paired devices and settings, Wi-Fi network configurations.
Home Screen Layout: Layout of the home screen, including widgets and icon placement.

HiSuite also allows for selective backups, meaning you can choose which types of data you want to back up or restore. The specific data backed up can vary depending on the version of HiSuite, the device model, and the Android version. Additionally, some app-specific data might not be fully backed up due to security and privacy restrictions imposed by the app developers.