Not so private: extracting data from PrivateSpace

We recently released the latest update to our all-in-one forensic solution, Oxygen Forensic® Detective. This update, Oxygen Forensic® Detective v.13.5, presented support for a brand new program, Huawei PrivateSpace. Now, investigators will have the ability to extract data from PrivateSpace on Huawei devices based on Kirin chipsets.

What is PrivateSpace?

Huawei PrivateSpace is a special program feature that creates a private storage space on Huawei or Honor smartphones. This storage space is completely separate from the device’s main storage and is configured to only allow access via fingerprint ID or password. The PrivateSpace password must be different from that of the main phone space. In PrivateSpace, users can store photos, videos, audio and contacts. Not only can files be stored but applications!  Apps can be stored and launched from this conveniently secret space..

Huawei PrivateSpace is so independent from main device storage that using it is comparable to using another phone. When files are stored to Huawei PrivateSpace  they cannot be accessed from the main menu of the device and cannot be extracted using  typical Android extraction methods. Any files stored here, including contact lists, are invisible to normal phone navigation. .

Huawei PrivateSpace was specifically designed to secure data and help users hide information from unauthorized access.  Oxygen Forensic® Detective is here to help uncover and acquire that data.

How Oxygen handles it

Although the data extraction from Huawei devices based on Kirin chipsets has long been supported by Oxygen Forensic® Detective, acquiring PrivateSpace data requires extracting additional hardware keys.

Their extraction and reading have been added to the main extraction process, which now looks like the picture below:

The password is required for decryption of both user and PrivateSpace data. Investigators can either enter it directly or launch the built-in brute-force module.

If brute-force was launched for main data, it would launch automatically for PrivateSpace, too.

Once account access is granted, extracted data from PrivateSpace will be accessible from the main device extraction screen in Oxygen Forensic® Detective. There, investigators can utilize any of the various analytic tools to parse the data and later build a report, if needed.

We are confident the addition of this feature will prove useful in acquiring additional critical data for any investigation involving PrivateSpace. For additional assistance with this tool or any others, do not hesitate to contact our Support Team.

2 thoughts on “Not so private: extracting data from PrivateSpace

Leave a Reply

Your email address will not be published. Required fields are marked *