[Case Study] SPF Pro Manual Backup Extraction Demonstration – Mobile Forensics

Product Tips
2022-02-10

In Mobile Forensics, App data backup extraction is an easy solution to acquire App data without rooting a smartphone. By using Android system’s backup feature, it is possible to create app data duplication which is saved in the SD card, which requires no root access.

In this demonstration, we used a Xiaomi Smartphone with MIUI system(powered by Android) as an example to demonstrate how to  backup and extract App data without rooting a smartphone.


Preconditions

  • The target smartphone must be functioning and can be powered up
  • The screen can be unlocked
  • The Android system backup feature is accessible for the users

Mobile Phone Operation Procedure

1.Go to Settings

img for CAS-SPF-001- Backup Extraction(Manually) 2022-1-24 - 1

2.Locate Backup & Reset (in other systems, it may also be Backup & Restore or other similar name)

img for CAS-SPF-001- Backup Extraction(Manually) 2022-1-24 - 2

3.Click Local backups

img for CAS-SPF-001- Backup Extraction(Manually) 2022-1-24 - 3

4.Click Back up to create a new backup

5.Then check the boxes of the apps you what to extract

6.Click Back up to start creating backup

img for CAS-SPF-001- Backup Extraction(Manually) 2022-1-24 - 4

img for CAS-SPF-001- Backup Extraction(Manually) 2022-1-24 - 5

7.Then wait for the process to complete

img for CAS-SPF-001- Backup Extraction(Manually) 2022-1-24 - 6

8.Connect the smartphone to a computer and extract the backup data from the SD card.
9.The storage location of the backup data is usually in a folder named backup
In this demo, the location is as follow: SD card\MIUI\backup\AllBackup

img for CAS-SPF-001- Backup Extraction(Manually) 2022-1-24 - 7

SPF Pro Operation Procedure

Now use SPF Pro to load and analyze the backup data you just extracted

  • Create a new case or open an existing case

 

  • Click Folder Analysis then find and load the backup folder acquired from the phone.

Note: Please load the root folder of the backup files (the upper folder of the app folders), otherwise SPF Pro may not recognize the backup files.

img for CAS-SPF-001- Backup Extraction(Manually) 2022-1-24 - 9

  • Click Automatic Logical Extraction
  • Select your extraction targets
  • Click Start to begin the process

img for CAS-SPF-001- Backup Extraction(Manually) 2022-1-24 - 10

  •  Wait for the process to finish and then you can see the extraction results

img for CAS-SPF-001- Backup Extraction(Manually) 2022-1-24 - 11

① Navigation Panel
Click here to navigate between different apps and categories.

② Triage Window
All extracted data will be displayed here.

③ Filter Bar
Set filters to quickly locate target data according to time, keywords, etc.

④ Report
Click to open the report window and generate a forensic report.

img for CAS-SPF-001- Backup Extraction(Manually) 2022-1-24 - 12

 

  • Leave a Reply

    Please rate

    Tell us about your experience

  • Leave a Reply

    Please rate

    Tell us about your experience