Practical Mobile Forensics - Fourth Edition

Joint Test Action Group

Joint Test Action Group (JTAG) involves using advanced data acquisition methods, which involve connecting to specific ports on the device and instructing the processor to transfer the data stored on the device. Using this method, a full physical image of a device can be acquired. It is always recommended to first try out the other techniques mentioned earlier, as they are easy to implement and require less effort. An analyst must be experienced and properly trained before attempting JTAG as the device may be damaged if not handled properly.

The JTAG process usually involves the following forensic steps:

1. In JTAG, the device Test Access Ports (TAPs) are used to access the CPU of the device. Identifying the TAPs is the ...