# DigitalEdge
## Mobile Forensics Integrated Workstation

> **One-line positioning:**
> A domestically developed mobile device forensics platform for law enforcement and the judiciary — **acquire / decrypt / parse / analyze / report** in one stack, **fully offline and under your control**.

---

## Table of contents

1. [Product overview](#1-product-overview)
2. [Seven core capabilities](#2-seven-core-capabilities)
3. [Technical strengths](#3-technical-strengths)
4. [Investigation workflow](#4-investigation-workflow)
5. [Capability matrix](#5-capability-matrix)
6. [Technical specifications](#6-technical-specifications)
7. [Typical use cases](#7-typical-use-cases)
8. [Product roadmap](#8-product-roadmap)
9. [FAQ](#9-faq)

---

## 1. Product overview

**DigitalEdge** is an integrated mobile forensics platform for **public security, prosecution, judicial appraisal, discipline inspection, and corporate compliance**, covering **iOS and Android** and major domestic OEMs — from **chip-level physical extraction** through **court-ready reporting**, implemented in-house.

### How we differ from legacy imported tools

| Dimension | Legacy imported tools | DigitalEdge |
|---|---|---|
| Protocols | Vendor SDK / cloud licensing | **Independent reverse engineering, protocol-level reimplementation** |
| Activation | Online activation, periodic phone-home | **Fully offline, no telemetry** |
| Huawei / Honor backup | Official HiSuite client | **In-house protocol; replaces HiSuite** |
| Classified deployment | Compliance constraints | **Native air-gapped / intranet deployment** |
| Extensibility | Closed | **Source can be escrowed and audited** |

---

## 2. Seven core capabilities

### ① Huawei HiSuite protocol — in-house (**unique in China**)

First domestic forensics tool to fully reimplement the `com.huawei.hisuite` backup protocol, reverse-engineered from HiSuite V2 / V10 / V11 / V14 APKs (**30+ analysis scripts, 40KB+ progress documentation**).

- **Crypto stack:** PBKDF2-HMAC-SHA1 + RSA-OAEP + AES-256-CBC + HMAC-SHA256
- **Frame:** 13-byte big-endian header (cmd / seq / flags / dlen)
- **Three channels:** AT^SETPROTO control / AT^SETAPKPUSH heartbeat / AT^SETSTREAM data
- **Five phases:** Init → ModuleInfo → BackupRequest → PullFinished → Cleanup
- **Coverage:** HarmonyOS 2/3/4, EMUI 9–12 — Huawei / Honor
- **Air-gapped:** No HiSuite install, no Huawei cloud

---

### ② iOS acquisition matrix

| Channel | Scope | Status |
|---|---|---|
| iTunes/Finder encrypted backup | All models | ✅ 10 dedicated parsers |
| checkm8 DFU physical | A5–A11 (iPhone 5s–X) | ✅ BFU / FFS |
| Lockdown services | All models | ✅ AFC |
| AFC / AFC2 filesystem | Jailbroken | ✅ Full FS |
| Backup password recovery | Encrypted backup | ✅ Dictionary + mask |
| iOS 12+ userland | A12+ | 📋 Third-party integration (planned) |

### ③ Android acquisition matrix

| Channel | Use case | Status |
|---|---|---|
| HiSuite backup | Huawei / Honor | ✅ In-house |
| HDB (Huawei ADB extension) | Deep + FBE/FDE decrypt | ✅ In-house |
| Generic AOSP ADB backup | Non-root Android | ✅ |
| Agent APK + APK downgrade | Hardened apps | ✅ |
| Qualcomm EDL 9008 | Lock screen / forgotten PIN | ✅ |
| OEM backup parse | Samsung / Xiaomi / OPPO / vivo / realme | ✅ |
| MediaTek BROM | Legacy devices | ⏸ Planned |

### ④ Removable media

Auto-detect USB, SD, readers; DD / E01 imaging or direct analysis; evidence metadata (brand, model, serial, custodian, notes).

### ⑤ Dual-view evidence browsing

Photos / video: **list ↔ gallery** toggle:

- List: name, size, dimensions, MIME, time, original path
- Gallery: 160×160 thumbnails, double-click fullscreen (zoom / fit / 1:1)
- Single-click: **EXIF + GPS + file hash**

---

### ⑥ Case dashboard — **investigation tool, not a file browser**

First screen when opening a case:

- **Evidence-type ring** — 11 categories at a glance
- **7×24 activity heatmap** — sleep/work patterns
- **Top 10 contacts / apps** — strongest ties surfaced
- **Monthly activity bars** — anomaly windows

### ⑦ Cross-table timeline

Live **UNION** across 10 sources:
SMS / calls / WeChat / QQ / WhatsApp / Telegram / Safari / Chrome / media / notifications

Filter by keyword / type / contact; default last 5,000 events, newest first.

---

## 3. Technical strengths

### Evidence integrity

- **Bookmarks / evidence tags** — Important / Suspicious / Confirmed / custom; row highlight; cross-device rollup
- **Hash verification** — SHA-256 end-to-end; `hash_log` for re-validation
- **Keyword + sensitive-data scan** — FTS-class full-case search; dedicated hit view
- **Normalized fields** — source path, timestamp_ms, filesize, hash on each artifact

### Parsing depth

**30+ dedicated evidence parsers**, including:

- Comms: SMS, calls, call recordings
- IM: WeChat, QQ, WhatsApp, Telegram, Feishu, DingTalk, Facebook Messenger
- China apps: Alipay, Douyin, Xiaohongshu, Amap, Baidu Maps, Didi
- Browsers: Safari, Chrome, Samsung Browser — history, bookmarks, cookies, downloads
- Location: GPS, Wi‑Fi, cellular, location services, iCloud Find My
- Health / fitness / sleep
- PIM: notes, calendar, reminders, contacts, groups
- System: notifications, clipboard, Siri, Spotlight, installed apps, crash logs
- Apple native: Journal, FaceTime, AirDrop, CarPlay, SOS, Find My

### Performance

- Qt 6.10.2 + MSVC 2022 native code — **no VM / no containers**
- SQLite WAL + prepared statement cache
- Parallel acquisition (isolated control channels)
- Task center: live progress, logs, cancel

### Compliance

- **Fully offline** — no foreign or OEM cloud
- **Auditable source** — no foreign SDKs except Qt
- **Classified-ready** — intranet out of the box
- **Encrypted cases** — SQLCipher in release builds (password held by customer)

---

## 4. Investigation workflow

```
┌─────────────┐ ┌──────────────┐
│ Create case │ ───► │ Case (.decase)│
└─────────────┘ └──────┬───────┘
│ │
▼ │
┌─────────────┐ │
│ Attach device│ │
│ (multi-device)│ │
└──────┬──────┘ │
│ │
┌──────▼──────┐ │
│ Pick channel │ ◄── 13 tutorials│
│ HiSuite/backup│ │
│ checkm8/EDL │ │
└──────┬──────┘ │
│ │
┌──────▼──────┐ │
│ Task center │ ─── parallel ─►│
│ progress/log│ │
└──────┬──────┘ │
│ │
┌──────▼──────┐ │
│ Parser pipe │ │
│ 30+ parsers │ │
└──────┬──────┘ │
│ │
┌──────▼──────┐ │
│ Dashboard │ │
└──────┬──────┘ │
│ │
┌──────▼──────┐ │
│ Analysis UI │ │
│ tree/gallery│ ◄── keyword scan│
│ timeline │ │
└──────┬──────┘ │
│ │
┌──────▼──────┐ │
│ Case bundle │ │
│ HTML + PDF │ ───► deliver │
└─────────────┘ │
┌───────────────────┘
▼
Offline backup / intranet handoff
```

---

## 5. Capability matrix

```
┌──────────────┬───────────────────────────────────────────┐
│ ACQUIRE │ iOS backup / checkm8 / AFC / AFC2 │
│ │ Huawei HiSuite / HDB / OEM backup │
│ │ ADB backup / Agent APK / APK downgrade │
│ │ Qualcomm EDL · USB/SD · DD & E01 │
├──────────────┼───────────────────────────────────────────┤
│ DECRYPT │ iTunes encrypted backup (+ password) │
│ │ HiSuite backup · Android FBE/FDE │
│ │ SQLCipher databases │
├──────────────┼───────────────────────────────────────────┤
│ PARSE │ 30+ category parsers │
│ │ WeChat / QQ / Alipay / DingTalk depth │
│ │ Browsers · maps · health · system │
├──────────────┼───────────────────────────────────────────┤
│ ANALYZE │ Case–device–category tree │
│ │ List + gallery · dashboard · timeline │
│ │ Search · EXIF/GPS · bookmarks/tags │
│ │ Keyword / sensitive hit views │
├──────────────┼───────────────────────────────────────────┤
│ REPORT │ HTML (today) · PDF (planned) │
│ │ Single-artifact export · hash chain │
│ │ Evidence bundle packaging │
└──────────────┴───────────────────────────────────────────┘
```

---

## 6. Technical specifications

| Item | Spec |
|---|---|
| **Deployment** | Windows desktop (x64) |
| **Environment** | Windows 10 / 11; 8 GB RAM min, 16 GB+ recommended |
| **Stack** | Qt 6.10.2 + MSVC 2022 + SARibbon |
| **UI** | Modern Ribbon, dark side navigation |
| **Database** | SQLite (dev) / SQLCipher (release) |
| **Network** | **Fully offline**; intranet OK |
| **Licensing** | Hardware fingerprint + offline license |
| **Platforms** | Full iOS generations + major Android OEMs |
| **Concurrency** | Multi-device acquisition + parallel tasks |
| **Reports** | HTML (shipped) / PDF (planned) |
| **Editions** | Single seat / site / enterprise |

---

## 7. Typical use cases

### Case 1 · Criminal — Huawei Mate 60 Pro
Suspect surrenders phone; legacy tools fail on HarmonyOS 4.
**DigitalEdge: HiSuite channel + backup password recovery — in ~2 hours: 80k+ WeChat messages, 3 years of calls, 1,200 deleted photos.**

### Case 2 · Anti-corruption — iPhone 14 Pro
Device PIN known; backup password unknown.
**Dictionary + contextual hints hit password in 17 minutes; parsers export WeChat Pay, Didi trips, DingTalk approvals, Safari history.**

### Case 3 · Compliance — former employee iPhone 8
Device returned; PIN withheld.
**checkm8 physical extraction (no PIN); AFC2 path fills enterprise WeChat sandbox — proves data exfiltration.**

### Case 4 · Field — USB + Xiaomi in parallel
**DD image of USB while AOSP backup runs on Xiaomi — ~40 minutes on site.**

### Case 5 · Group — three phones, one case
**Dashboard shows shared high-frequency contacts; timeline overlaps calls; keyword hits tagged “Important” go straight into the bundle.**

---

## 8. Product roadmap

### Shipped (as of December 2025)

**Acquisition:** HiSuite (Huawei/Honor), iOS iTunes (10 parsers), checkm8 (A5–A11), AFC/AFC2/Lockdown, iOS backup password recovery, Android HDB + FBE/FDE, Qualcomm EDL, ADB/Agent/APK downgrade, OEM backups, removable media DD/E01.

**Parsing:** 30+ parsers; deep WeChat/QQ/Alipay/DingTalk; Apple Journal, Find My, AirDrop, CarPlay, etc.

**Analysis:** Three-level tree, list + gallery, dashboard ring + heatmap, 10-source timeline, bookmarks/tags, keyword + sensitive scan, hash verification, 13 embedded tutorials.

### 2025 Q1 (next)

- Timeline UI: type filters, time brush, double-click to source
- Unified deleted-evidence view
- SHA-256 during acquisition
- Map view + **offline tiles** (required for classified sites)
- Preset sensitive libraries
- PDF reports (logo + examiner signature block)

### 2025 Q2

- Relationship graph / social network
- Cross-device entity merge
- SQLite WAL / free-page recovery
- Export bundle of tagged evidence only

### 2025 Q3–Q4

- Offline OCR (CN/EN)
- AI image classes: ID, NSFW, weapons, drugs, cash
- Face clustering
- Encrypted container detection
- iOS A12+ userland (integration)
- MediaTek BROM execution

### 2026

- Cloud: iCloud, Huawei Cloud, WeChat backup
- Cross-case comparison
- Kylin / UOS builds
- Multi-examiner collaboration

---

## 9. FAQ

**Q1: How long for a Huawei Mate 60 Pro?**
A: Backup channel ~30–120 min (data volume). Deep IM parsing adds ~15–30 min.

**Q2: Jailbreak / root required?**
A: **Usually no.** HiSuite, iTunes, AOSP, OEM backups use official paths; checkm8 is a hardware exploit; EDL is Qualcomm native. Jailbreak (AFC2/SSH) is optional depth.

**Q3: Works without network?**
A: **End-to-end offline.** One-time offline activation; acquisition, parsing, analysis, and reporting need no network.

**Q4: Custom development?**
A: **Yes.** Source can live on customer Git under NDA. Parsers are C++ modules.

**Q5: vs UFED / Oxygen?**
A: Complementary — **domestic alternative + classified-first.** Imports lead on A12+ userland and cloud; we lead on HarmonyOS, domestic apps, and **offline compliance**.

**Q6: Export case data to other tools?**
A: Core tables are SQLite; CSV / JSON / HTML export; SQLCipher supported.

**Q7: Phone coverage?**
A: Full iOS + Huawei/Honor/Xiaomi/OPPO/vivo/realme/Samsung/OnePlus/iQOO; Qualcomm, MediaTek, Kirin, Exynos.

---

## Contact

- **Vendor:** [Your organization name]
- **Website:** [Website]
- **Sales:** [Phone] / [Email]
- **Support:** [Phone] / [Email]
- **Partnerships:** [Phone] / [Email]
- **Address:** [Address]

---

*Content current as of December 2025. Capabilities evolve; shipped features follow the delivered build.*