An Ultimate Guide on How to Extract Data from OPPO Phone.

Overview

Mobile phone forensics refers to the process of recovering digital evidence of investigative significance by collecting, preserving and analyzing mobile devices, and ultimately obtaining legally binding evidence that is acceptable to the court. Just as citizens use mobile devices, so do criminals. The main reason for the rise in cybercrime rates is the use of digital devices to store credentials, bank details, etc. Because of the many hardware, software, and file system differences that exist in mobile devices, mobile device forensics cannot be conducted in the traditional computer forensic manner. When it comes to mobile devices, there are many closed and open source operating systems, which makes mobile device forensics more difficult. As a result, there has been a lot of growth in the field of mobile forensics, covering mobile devices such as feature phones, smartphones, and tablets. In some cases, mobile forensics can help investigators successfully collect information from compromised phones. Analyzing mobile devices while recovering digital evidence can help every investigator extract data and finally solve cases in a short time.

Common Methods for Mobile Forensics to Extract Data

Nowadays, there are many methods to extract data on mobile phones. Here are some common methods:
1. APP Implanting

Implant Apps into the mobile phone, by which normal text messages, contacts, call records, files and other data can be extracted.

Defects:

1) Restricted by security mechanisms (screen lock, USB debugging, system permissions, etc.)

2) Only normal basic data in the mobile phone can be extracted, deleted basic data cannot be extracted.

3) Usually blocked by built-in security software.

2.ROOT

Need to obtain the ROOT permission of the mobile phone to collect data. In the case of ROOT, investigators can extract data in the mobile phone (including normal and deleted data).

Defects:

1) Restricted by security mechanisms (screen lock, USB debugging, system permissions, etc.)

2) The higher the system version, the more difficult the operation and the greater the risk.

3. Backup Extraction

Need to use official mobile assistants, such as ‘Hisuite’ or the built-in backup function of mobile phones such as OPPO and Xiaomi.

Defects:

1) Only normal data can be extracted for basic data, deleted data cannot be extracted.

2) Unable to get data from App clone.

4. Qualcomm 9008 /MTK Physical Extractor

In the shutdown state, physical imaging is performed through system vulnerabilities for data analysis. Investigators need to pay attention to the version of the Android system.

Defects:

Not support for mobile phones with higher version of Android.

For some special models of OPPO phone (the Android system version is below Android 9), all of the above data extraction methods are not applicable.

For this kind of case, SalvationDATA has developed the WiFi extraction method on OPPO phone, that is to connect the WiFi hotspot of OPPO phone with computer to extract data.

Case Study

There is a mobile phone with an Android system version lower than Android 9, in which common extraction methods are not supported. So we select “OPPO Clone Phone” on SPF Pro to extract data by connecting the WiFi hotspot of OPPO phone with computer.

• Device: OPPO phone
• Tool: SPF Pro(SmartPhone Forensic System Professional)
• Method:WiFi extraction

1. Select “OPPO Clone Phone”(WiFi extraction) between the following two extraction modes.

2. Click “Continue” to the next step.

3. Do not click “Skip” or “Continue” on this interface. Follow the prompts in the prompt box.
4. Settings->Network & Connections->Mobile Hotspot

5. Edit network properties of mobile hotspot.

6. Enter “Network name” and “Network password” and then save.

7. Click “Continue” to the next step

8. Click “Confirm” to automatically turn off the firewall.

9. Extracting Data

Notes

1. Make sure to keep the mobile phone and computer connected via USB cable while extracting data.

2. Please use the latest version of SPF Pro and check the software version firstly to see if the software is the latest version.

3. Do not turn off the computer’s WiFi hotspot while extracting data. Otherwise, only the basic data of mobile phone(such as SMS, contacts, etc) can be extracted.