Practical Mobile Forensics - Third Edition

Joint Test Action Group

Joint Test Action Group (JTAG) involves using advanced data acquisition methods, which involve connecting to specific ports on the device and instructing the processor to transfer the data stored on the device. Using this method, a full physical image of a device can be acquired. It is always recommended to first try out the other techniques mentioned earlier, as they are easy to implement and require less effort. Examiners must have proper training and experience prior to attempting JTAG, as the device may be damaged if handled improperly.

The JTAG process usually involves the following forensic steps:

• In JTAG, the device Test Access Ports (TAPs) are used to access the CPU of the device. Identifying the TAPs is the ...