Development of Xiaomi Product Mobile Forensic Acquisition Framework on Second Space Features Based on SNI/ISO 27037:2014

: In conducting digital forensic activities, references or standards that must be followed serve as guidelines for the processes performed by investigators. One of the frameworks that can be adhered to is the SNI ISO 27037, which constitutes Indonesia’s digital forensic standard governing the guidance for identification, collection, acquisition, and preservation of digital evidence, adopted from ISO 27037:2012. Mobile forensics, a branch of digital forensics, deals with the examination of mobile devices, and one such mobile device vendor is Xiaomi. Xiaomi offers a unique "Second Space" feature that segregates and divides internal storage. This feature poses a challenge for investigators in forensic activities as the SNI ISO 27037 does not explicitly regulate how to obtain digital evidence from a phone equipped with such a unique feature. The existence of the Second feature in Xiaomi products becomes a challenge for investigators to acquire legally admissible evidence in court by lawful means. The method employed in this research is a quantitative approach involving direct analysis (live forensics) to gather evidence from Xiaomi’s Second Space feature. The outcome of this study is a workflow or framework designed to procure digital evidence from Xiaomi’s Second Space feature, utilizing MobilEdit Forensic Express Pro, one of the digital forensic tools for mobile forensics. The constructed framework can be implemented for other phones featuring a similar Second Space function; however, as of now, only a limited number of phones possess this feature. Thus, establishing this framework can assist future investigators in acquiring digital evidence from mobile devices equipped with specialized features.


Introduction
The evolution of technology poses a significant challenge within the realm of forensics [1].Among the continually advancing technologies, mobile devices stand out as electronic tools facilitating the exchange of information, encompassing data, audio, and video.Besides serving communication purposes, mobile devices are increasingly prominent in cybercrime scenarios cases [2].One of the mobile device vendors is Xiaomi.In its development, Xiaomi provides special features for its users, namely the unique feature of the Second Space.This Second Space feature is only developed by Xiaomi on Android smartphones; this Second Space feature can be activated on Xiaomi smartphones that have MIUI version 8 and above.Xiaomi stands as one of the prominent vendors in the mobile device industry.Throughout its evolution, Xiaomi has introduced distinct functionalities for its users, notably the unique feature known as the "Second Space."This specific attribute is exclusively incorporated into Xiaomi's Android smartphones, available for activation on devices running MIUI version 8 and higher.
The Second Space represents a feature that Xiaomi's smartphone developers crafted, enabling users to establish two distinct mobile environments within one device.Within this Second ary Space, users can share storage space, offering different access privileges and distinct storage locations.This particular feature was devised to uphold the data security of its users, mandating authentication measures such as lock screen passwords, MIUI account passwords, Second Space access passwords, and fingerprint verification for access.Notably, this Second Space feature significantly influences the handling process of digital evidence from mobile devices, an area commonly referred to as mobile forensics.Mobile forensics is a specialized field within digital forensic science, focusing on analyzing and exploring digital traces within mobile devices.
One of the processes of handling electronic evidence on mobile devices is acquisition [3]; acquisition is a process carried out to obtain digital traces on a device, which will later be used as evidence at trial [4].To carry out the acquisition, a standard procedure is needed that can be a reference for investigators in carrying out the acquisition process.One of the standards that can be used as a standard or acquisition procedure is SNI ISO 27037.SNI ISO 27037 is a guideline for handling electronic evidence recognized in Indonesia as SNI (Indonesian National Standard), which was approved on 28 November 2013 in Bogor.SNI ISO 27037: 2014 is allowed to perform logical acquisitions carried out by investigator officers, namely Digital Evidence First Responders (DEFR) [5].
There are four stages in searching for evidence: Acquisition, Preservation, Analysis, and Presentation [6].The SNI ISO/IEC 27037:2014 document has provided a complete explanation of each process of handling electronic evidence by definition, but there are areas for improvement in technical terms.Each step that must be taken in carrying out the digital forensic process must be explained in detail.Because each device has different characteristics, the investigator must be able to find an appropriate and suitable method in carrying out the digital forensic process according to the device being analyzed and can be accounted for in every process [7].
However, looking at the development of existing mobile devices, SNI ISO 27037 still needs to cover the acquisition process by the characteristics of Xiaomi devices.Xiaomi mobile devices have different storage characteristics that require investigators to find a framework that is suitable for Xiaomi devices.As explained, Xiaomi has a Second Space feature that separates storage media but remains on one device; thus, to perform acquisihttps://ejournal.ittelkom-pwt.ac.id/index.php/infoteltion on Xiaomi devices requires two acquisition processes, resulting in two extractions obtained from one device.SNI ISO 27037, which constitutes Indonesia's digital forensic standard governing the guidance for identification, collection, acquisition, and preservation of digital evidence, adopted from ISO 27037:2012.SNI ISO 27037 has provided guidelines for investigators to carry out the acquisition process, namely in clause 7.1.3Acquisition, there are three scenarios where the acquisition is carried out, namely: when the digital device is turned on, when the digital device is turned off and when the digital device is turned on and cannot be turned off [8].The acquisition process that is suitable for Xiaomi mobile devices is the acquisition of digital devices in the on state, because the Second Space has different characteristics from other devices in terms of data storage, the acquisition process must be adjusted.
By considering the existing problems, this research will develop a workflow as a guideline for the DEFR in acquiring Xiaomi mobile devices with the unique features of the Second Space based on SNI ISO 27037:2014.To support the preparation of this research, the author reviews previous methods conducted by Aji et al. [3], who developed a workflow or workflow in conducting logical acquisitions on smartphones using the live forensic method using the Laron application, which is adjusted to SNI ISO/IEC 27037:2014 with several requirements, research conducted by Sudyana et al. [9] explains that the current framework has shortcomings where there are stages in the framework that are not by SNI ISO 27037 [10].The difference between this research and previous research lies in the object of research, namely the Xiaomi mobile device with unique features of the Second Space, which has different characteristics from mobile phones in general, so it requires the development of a workflow/framework in the acquisition process.
In the preparation of this research, the author is also not far from the previous researcher's review of the acquisition framework based on SNI ISO/IEC 27037; the following is a brief description of the studies that have been summarised: One of the frameworks developed using the Laron application as a logical acquisition application licensed by MIT [6].According to the author's observation data, evidence in the form of smartphones always increases every year, so it is possible to increase crimes using smartphones in the future.So, the author built an acquisition framework using the Laron application based on SNI ISO 27037:2014.With the construction of this research, it is hoped that it can help DEFR's task in conducting smartphone acquisitions based on SNI ISO 27037:2014.
Previous research discussed the logical acquisition process on Android devices using open-source applications.The study discusses open-source applications that can be used as tools in the acquisition process of Android devices by paying attention to recognized standards, namely SNI ISO 27037:2014 [3].The applications used in this study are AFLogical OSE and Laron, which consider the logical acquisition framework and use requirements such as mobile phones being on, unlocked, and ADB enabled.The results show that the AFLogical OSE application can obtain digital artifacts in the form of SMS, MMS, Contact List, and Call Log, while the Laron application obtains digital artifacts in the form of a database installed on the mobile phone.
Related research conducts digital artifacts searches on smartphones with unique features, namely Dual App on Xiaomi phones [11].Due to the development of mobile cellular devices that continue to grow with increasingly varied innovations, special handling is needed.Rapid actions in the mobile cellular world significantly affect the forensic process regarding rules, procedures, and handling.By conducting an analysis using Andriller and Laron, it turns out that the location of the database in the Dual App feature cannot be de-tected automatically, so a manual search is carried out to find the artifacts sought.Because the Andriller and Laron applications are still open-source, it is hoped that in the future, it will be possible to search for digital artifacts with a logical acquisition application in the application that runs on the Dual App.
To support this research, the author takes the same research object as the previous author, who discussed the search for digital artifacts in the Mi Video application on Xiaomi phones using the Live Forensic method [12].Xiaomi smartphones are growing yearly, both in terms of sales and production.The UI design update on Xiaomi phones called MIUI in version 9 has many changes, especially in added features such as Mi Drop, Mi Music, Mi Video, and Special Features.Besides being a tool for playing videos, Mi Video also has a Log that stores user activity on the device.So, the author investigates the Mi Video application to get digital artifacts stored in the Mi Video Log.The results of this study are digital artifacts found in the Mi Video Log that can be used as evidence, but to gain access to the Log requires root access.Due to the unique structure of Xiaomi mobile phones, the device must be on to carry out this investigation process using the Live Forensic method [13].
Previous research has discussed technology development on mobile devices and their features.Still, earlier research has yet to discuss the unique features of the Second Space on Xiaomi.Due to the rapid development of technology on mobile devices, this research is essential and can be helpful for investigators in conducting digital forensic processes on mobile devices.The kedia Space feature has different specifications from other devices in terms of storage, so it requires some additions to the acquisition process of the Second Space feature Xiaomi device based on SNI ISO 27037:2014.

Research Flow
At this stage, the flow of the research process that will be carried out will be explained; the process in this research is Literature Study, Problem Identification, Framework Identification, and Framework Evaluation with SNI ISO 27037:2014.SNI ISO 27037 framework SNI 27037 is an Indonesian digital forensics standard regarding guidelines for identifying, collecting, acquiring, and preserving digital evidence adopted from SNI ISO 27037:2012, Building Framework, Framework Implementation, Framework Implementation Evaluation, and Conclusion.This research was built by conducting a framework development study and adjusting digital forensic standards in carrying out the process of investigating digital evidence; this research focuses on the unique features of Xiaomi mobile phones, namely Second Space, by adjusting the SNI ISO 27037:2014 standard which is used as a reference or measure in conducting digital forensic activities in Indonesia.Each process or flow of this research has been summarized and will be explained in Figure 1.
As in Figure 1, this research is built from a literature review collected and analyzed by the object of study, namely, the acquisition framework and special features of Second Space on Xiaomi Android devices.
Problem identification is determining the formulation of problems by adjusting the object of research, namely Xiaomi smartphones and Second Space features.Identification of the issues taken from previous research related to storage on mobile devices that will be analyzed according to research needs.https://ejournal.ittelkom-pwt.ac.id/index.php/infotelAfter analyzing as needed, the researcher analyzed the framework used in the acquisition process using the SNI ISO 27037:2014 standard in many digital forensic acquisition processes.This standard was chosen because it already has SNI, is recognized in Indonesia as one of the standards that DEFR can use in carrying out digital forensic processes, and has the power to prove cases in court.SNI ISO 27037, a guideline for investigators used in this research, will be evaluated with the needs of the research so that the requirements in SNI ISO 27037 are met, and the framework built has strength in the process of proof for investigators and is valid in court.
After analyzing the appropriate framework, the researchers built a framework based on the SNI ISO 27037:2014 standard by paying attention to each clause contained in SNI ISO 27037:2014 so that the framework built has a strong foundation and has the proper basis for carrying out the digital forensics process.
After building the framework and having the appropriate case scenario, the framework implementation process in the file acquisition process in the Second Space can be carried out.When implementing the framework on the object of research, researchers also carry out documentation, which is one of the requirements in the SNI ISO 27037:2014 clause.
After the implementation process was completed, the researcher used an observational method approach to evaluate the effectiveness of the framework built by paying attention to the acquisition results; observations were made by paying attention to the requirements in the SNI ISO 27037:2014 clause and the obstacles that occurred during the implementation of the framework.Evaluation of the framework is carried out by analyzing each process, which must be by SNI ISO 27037 standards to recognize the framework's application.The framework built is a development of the acquisition process of SNI ISO 27037 clause 7.1.3,which is the process of acquiring digital evidence of the device; this acquisition process was chosen because, in the process of acquiring the Xiaomi device, the Second Space feature must be done in the state of the device on.The Second Space is a sensitive feature; if the acquisition process is carried out on a dead Xiaomi device, the Second Space cannot be connected.Observations are also made on the acquisition results; this research discusses the development of the framework and the characteristics of the Second Space, which is considered a gap for criminals in hiding digital evidence.
After the evaluation, it will conclude that the framework built is practical based on the standards and requirements needed in the file acquisition process on the unique features of the Second Space/Second Space of Xiaomi mobile devices.

Case Scenario
In accordance with Figure 1 where the case scenario is built in the problem identification process to be carried out.The case scenario built in this study aims to analyze the Second Space acquisition process, so that the file to be acquired must be in the Second Space.To clarify the case to be built, it is explained in Figure 2. The case scenario built in this study will perform two storage of image files with .Jpeg format stored in the First Space and the Second Space, the purpose of storing in both Space s to be analyzed in the acquisition process.The Second Space storage is a separate storage with the main Space, to get files in the Second Space must get access to the First Space First, so with this different storage, it will be possible to analyze the storage Space.The acquisition process carried out using the MobilEdit application will detect the storage on the mobile phone, the file stored in the First Space is stored with the file name First Space .Jpeg and the file in the Second Space with the file name Second Space .Jpeg.
First Space .Jpeg file stored in the First storage is located in the internal storage folder/FILE EVIDENCE 1/First Space .Jpeg, while the Second Space .Jpeg.file is stored in the internal storage folder/FILE EVIDENCE SECOND SPACE /Second Space .Jpeg.To be able to access the Second Space, First Space access is needed such as, lock screen password, https://ejournal.ittelkom-pwt.ac.id/index.php/infotelMI account, Fingerprint (if needed), developer mode or developer access, and password login Second Space.In this case, the Second Space feature has been activated on a Xiaomi device with specifications as shown in Figure 3.The First and Second Space storage on Xiaomi phones have separate jolly that can be done manually analyzed on the primary storage; there is a difference before and after the Second Space is activated; on the First Space before the Second Space is made, the storage used on the phone is 33.7 GB / 64 GB, but after activating the Second Space the storage becomes 35.1 GB / 64 GB it can be seen that the main repository has been used 1.4 GB, the difference can be seen in Figure 4.

Xiaomi's Second Space
Second Space / Second Space is a unique feature developed by Xiaomi developers for users who have mobile specifications that have MIUI updates above version 9.This Second Space is here to provide more access to users in storing files that are more secure by utilizing storage that can be divided into two different Spaces with different access; the principle of this Second Space is the same as the open-source virtualization process on Windows, where an installed OS can create a new OS that has different storage with different access, conceptually this is almost the same as what Samsung has, namely Samsung Knox [14].The difference between Second Space and Samsung Knox is in the access; Xiaomi provides more special access for users who have MIUI accounts and must have more access to be able to operate Second Space, while Samsung Knox is a feature where control of a mobile phone can be monitored or controlled by other parties who have the same network and have IP control.To access Second Space, Xiaomi phone users only need to activate it in settings -special features -Second Space, see Figure 5.

Framework
NI ISO 27037:2014 is a standard procedure that is a reference for digital forensic practitioners in analysing and investigating digital evidence [9].SNI ISO 27037 explains the procedures in handling digital evidence including the handling of mobile devices [15].
But in practice, SNI ISO 27037 only provides general procedures in handling electronic evidence that is universal; of course, this is a new challenge for digital forensic practitionhttps://ejournal.ittelkom-pwt.ac.id/index.php/infotelers where in the development of existing technology, investigators are required to be able to find methods that are suitable for the device being analyzed.In this case, the forensic process that will be developed is the acquisition process, according to SNI ISO 27037:2014 clause 7.1.3in section 7.1.3.1.1.1Summary, it has been explained that "DEFR can follow several guidelines for acquisition when the device is found to be turned on.Not all guidelines are ideal and appropriate for all cases; some guidelines are only relevant for certain cases."This is the basis and reason for investigators to develop suitable acquisition methods for the case being handled.On the other hand, SNI ISO 27037 also provides guidelines for acquiring active digital devices, see Figure 6. Figure 6 explains how the acquisition process is carried out on an active digital device.Of course, this should be a guideline for investigators in carrying out the acquisition process, but on the other hand, a new problem is found where the device is.The object to be acquired has different specifications, whereas the Xiaomi mobile phone has different storage and other potential storage gaps.Xiaomi provides a feature for users to separate the central repository from personal storage, and this will undoubtedly be a different process when performing the acquisition process by the SNI ISO 27037 standard in Figure 6.The difference in the acquisition process is in the results/output of the imaging file; when extracting a mobile phone, it will produce an extraction file which will later be analyzed, in contrast to Xiaomi, which has a Second Space feature, when the investigator analysis this phone it is possible that it will produce two extraction files with the same extension and have the same file contents, but the study will produce different conclusions.
To get extraction results that are in accordance with the SNI ISO 27037:2014 standard, the framework built will be adjusted to the features and processes on the mobile phone because Xiaomi has a unique feature, namely the Second Space, to separate the storage media, the process will be carried out for file acquisition twice, see Figure 7. Figure 7 shows how the acquisition process is carried out.To perform the acquisition process in the Second Space, Xiaomi mobile phones must undergo two acquisition processes in one mobile phone.The process carried out to carry out the acquisition in the First Space can be done using the reference or standard SNI ISO 27037:2014, which can be a reference for investigators, but in carrying out the acquisition process of the Second Space, the same thing must also be done.There are several requirements in conducting the acquisition of the Second Space: 1.The Second Space acquisition process must be done after the First Space acquisition process is complete 2. The process to access the Second Space must go through the First Space.3. Some authentication requirements are needed, such as the First Space password/key, Second Space key, and fingerprint to enter the Second Space.4. A USB Debug is required in the Second Space to be able to perform acquisition, USB Debug is not valid if it is only done in the First Space. 5. Additional processes can occur if problems are found during the acquisition process, such as rooting the mobile phone in certain circumstances, the process fails because the mobile phone sleeps, if the mobile phone sleeps, the Second Space will automatically lock the mobile phone will automatically open the First Space.

Acquisition Process
The acquisition process is carried out by connecting the Xiaomi Redmi Note 8 mobile phone to the MOBILedit Forensic Express Pro v7.4.0.20393 acquisition application; as previously explained that to carry out the acquisition process must go through two methods, namely, the First Space is acquired, and the acquisition is carried out in the Second Space.Process for acquiring Xiaomi devices with the MobilEdit application can be seen in Figure 8 [16].Still, before making an acquisition, several requirements must be made, namely: activate developer mode to be able to activate USB Debugging; after USB debugging is activated, then activate the install application via USB; this is done to allow the mobile phone to install the connector application needed by the MobilEdit application, see Figure 8. https://ejournal.ittelkom-pwt.ac.id/index.php/infotelAfter the connector is successfully installed, the next step is to carry out the acquisition process in the First Space; the steps in this process include selecting what you will extract, configuring the results to select the output of the imaging file, filling in the extract result form, select the format of the extracted file, select the destination of the imaging result storage location and the last step is to wait for the imaging results to be completed.In this research, the extraction results are selected in the form of .pdffiles, and the file analysis carried out by imaging is selected image files because this research aims to develop a framework.While the acquisition process until the extract results are obtained will not affect the file type, the difference from the file acquisition to imaging will depend on the size of the file; the larger the file size, the longer the imaging process will take, but for the procedure from the beginning until the extraction process is complete there is no difference.The results of the extraction file can be seen in Figure 9, and the .pdfreport can be seen in Figure 10.

Evaluation
After analyzing the object of research, namely the unique features of the Xiaomi Second Space, and paying attention to the standards used in this study, it can be concluded that it is necessary to build a framework that can be utilized in carrying out the Xiaomi Second Space acquisition process.Considering the acquisition process guidelines from SNI ISO 27037:2014, the process is to the Xiaomi mobile phone situation.Still, it is necessary to add several approaches to the framework due to several circumstances.After doing some analysis on the Xiaomi Second Space, some additional requirements need to be considered in the acquisition process, namely: 1.To access the Second Space, we need: First Space password, MIUI account access, Second Space password, and fingerprint (if needed).
2. The Second Space is a very power-sensitive feature, if the acquisition is done in the Second Space, the mobile phone must be on.The acquisition process will fail because if the Second Space is off/sleep then the Second Space will automatically be locked and the process for acquisition must be repeated.
3. The settings in the First Space and the Second Space are different, this greatly affects the mobile phone settings where the required USB debug and application connectors must be installed in both Spaces.
4. To enable USB debugging in the Second Space, developer mode must be enabled in the First Space.Despite having different settings, the settings in the Second Space are not as complete as in the First Space.Some accesses such as developer mode are only available in the First Space.
Considering this, the researcher will develop an acquisition method in the Second Space.The acquisition process is based on SNI ISO 27037:2014; the acquisition process that suits the requirements of the Second Space is the acquisition process of active digital devices (clause 7.1.3SNI ISO 27037:2014) by performing several additional functions according to the state of the mobile phone.The acquisition process is carried out using the MOBILedit Forensic Express Pro v7.4.0.20393 application; investigators can utilize this application to conduct easy-to-use mobile device acquisitions.This MOBILedit application has a connector that must be installed on the connected mobile phone with USB Debugging requirements and permission to install applications via USB [17].
This research produces two extraction files with different storage from one mobile phone, with the process repeated but with the same mobile phone, making the extraction results questionable.In general, a device that is analyzed will produce one extraction file; even though it has different file storage, it still produces one file after being extracted with the application, but it is different from the Xiaomi phone, which can separate the central repository with the Second storage when an analysis is carried out using the application to get the file being searched, the file cannot be found, there must be an additional process carried out to access the file stored in the Second Space.After analyzing the details of the First Space device and the Second Space, the difference in detailed properties can be seen in Figure 11.
From Figure 11.It can be seen that there are some differences from the device properties analyzed with the MobilEdit application.The same manufacturer description and the same https://ejournal.ittelkom-pwt.ac.id/index.php/infotelproduct, namely Redmi Note 8, but the Android ID has a different description [18], this is because the Second storage Space is a different storage as if the same mobile phone has been created with a different ID but has the same Hardware (HW) Revision [19], and the same serial number.In addition, the IMEI of the two identification results gives the same results, this indicates that the product being analyzed is the same product where the IMEI is the identity of a device where there is no same IMEI for each device [20].In addition, in the device properties of the Second Space there is a description of LACCID which is not found in the device properties of the First Space [21], LACCID is a combination of LAC (Location Area Code) and CID (Cell ID) [22], LAC is a unique code of the detected location and can change while CID is a unique number or code that identifies the BTS (Base Transceiver Station) tower in the location area which can also change according to location [23].In addition, there is IMSI (International Mobile Subscriber Identify) information which is the identity of the GSM network [24], the First three numbers 510 are MCC (Mobile Country Code) identifying that the network connected to the device is in Indonesia, and the next two numbers are MNC (Mobile Network Code) the identity of the operator connected, 89 is the identity for operator 3 (Three) [25].

Result
After analyzing the Xiaomi Second Space storage and determining suitable methodologies, this research yielded a method development for acquiring data within the Xiaomi Second Space to support the admissibility of digital evidence in court.The evaluation process determined the prerequisites required to develop the acquisition method, and the methodology employed was highly contingent on the device under scrutiny.In this study, a quantitative approach was utilized, involving formulating problem statements, hypothesis development, experimental design and execution, conclusion drawing, and result reporting.
The framework employed in this study was SNI ISO 27037:2014, an Indonesian digital forensic standard outlining guidelines for the identification, collection, acquisition, and preservation of digital evidence, adopted from ISO 27037:2012.The approach adopted in this research was Live Forensic, a process of digital device acquisition conducted while the device is powered on.This procedure was imperative as accessing the Second Space on Xiaomi devices is mandatory.
One of the applications used for Mobile Digital Forensics on mobile devices is MobilEdit Forensic Express Pro, which can acquire and generate image files from mobile devices.The requirements for accessing the Second Space were also detailed within this framework.https://ejournal.ittelkom-pwt.ac.id/index.php/infotelCurrently, this framework cannot be universally applied to numerous types of phones, as the Second Space feature is exclusive to Xiaomi.However, there is a possibility that in the future, many mobile vendors will develop similar features.Hence, this research construction will aid researchers in acquiring insights into the specific Second Space feature.The developmental outcomes of the framework are illustrated in Figure 12.
Figure 12 is a proposed Framework that has been analyzed in each clause of SNI ISO 27037:2014 and is a contribution to this research; the framework built is a development of the SNI ISO 27037:2014 acquisition procedure where there are several additions in the SNI ISO 27037 procedure only one acquisition and imaging process is carried out by producing one extraction file, in contrast to the Second Space feature Xiaomi which will produce two extraction files with two acquisition processes on one mobile phone or mobile device.The additions contained in the acquisition procedure are: 1. Repeating the First process by enabling USB Debbug on the Second Space with developer mode access permission on the First Space.
2. Collecting data needed to access the Second Space such as the Second Space password and fingerprint.
Install the MobilEdit application connector on the Second Space by enabling the application to install via USB permission in the Second Space settings.The investigator can use this framework for some phones with special Second Space features, such as Samsung Knox, a special part built by Samsung to separate the main Space and the Second Space.This framework can also be used to anticipate the rapid development of technology, and there will be many possibilities that other cellphone vendors will provide special Second Space features.

Conclusion
After implementing the case and analyzing the SNI ISO 27037:2014 framework, it is concluded that the Second rack storage on Xiaomi phones has different specifications from other telephones held in the Second Space, has a different storage location from the First Space and separates RAM and ROM in different Spaces.The Second Space is a virtual machine built by Xiaomi developers to separate the Space on the primary storage, just like doing dual boot on a laptop, but there are differences in accessing it.When doing Space division on a laptop virtual machine, we can choose the size used in another Space, but in the Second Space, we cannot determine the storage size.
To perform the acquisition process in the First Space can be done with the acquisition process contained in the SNI ISO 27037:2014 standard, but to perform activities in the Second Space, some additional processes must be done.In carrying out the acquisition process in the Second Space, several requirements must be met, namely the First Space password, MIUI account access, Second Space password, and fingerprint (if needed), the Second Space is a feature that is very sensitive to power, if the acquisition is carried out in the Second Space, the mobile phone must be on.The acquisition process will fail because if the Second Space is off/sleep, the Second Space will automatically be locked and the process for acquisition must be repeated, the required USB debug and application connector must be installed in both Spaces, To enable USB debugging in the Second Space, you must activate the developer mode in the First Space.

Figure 1 :
Figure 1: Research flow of second space acquisition.