A study on data acquisition based on the Huawei smartphone backup protocol

Abstract

Smartphones, which offer various features such as SMS/MMS, scheduling, messaging, and SNS, have become an integral part of modern life. Smartphones manage information intimately related to users in a self-contained manner, allowing them to provide such convenience efficiently. Such data, which can be used as key digital forensic evidence, are prime targets for investigators. However, exacting relevant data from smartphones with complicated structures requires considerable expertise. The analysis of smartphone backups is one approach to solving this problem. Smartphone manufacturers provide users with programs that include a backup protocol for backing up smartphone data. These programs allow investigators to easily extract smartphone data. Efficient smartphone data extraction is possible by integrating backup programs using different backup protocols into one framework. To achieve this integration, it is necessary to analyze each smartphone manufacturer's backup protocol. In this paper, we describe the results of analyzing the Huawei smartphone backup program HiSuite. HiSuite uses its backup protocol to produce backups of smartphones. We uncovered the entire process of the backup protocol through reverse engineering. We also experimentally verified that it is possible to obtain backup data from Huawei smartphones using the tool we developed to replace HiSuite based on our analysis. We believe this paper will help digital forensics investigators develop a better approaches to collecting data from smartphones.