Glossary term
ISP Forensics
ISP stands for In-System Programming. In mobile forensics, ISP refers to the technique of acquiring a forensic image from a device through the eMMC test points on its printed circuit board, without removing the memory chip.
ISP is a non-destructive advanced acquisition technique. Where a phone cannot be acquired through Cellebrite or Magnet AXIOM (because it is locked, damaged, or unsupported), the eMMC test points on the board can sometimes be accessed directly with a specialized rig, allowing acquisition of the raw flash content without desoldering the chip.
Compared to chip-off, ISP is faster and less invasive: the device can often be reassembled and returned afterward. Compared to JTAG, ISP can sometimes succeed where the JTAG debug port is unavailable or unsupported by the chipset.
The technique requires microscope work, board-level rework equipment, and specific adapter rigs for each device type. We perform ISP in-house at our Langley lab.
ISP is one of three advanced extraction techniques we operate, alongside chip-off (destructive) and JTAG (non-destructive, debug-port based). The right technique depends on the device condition and the matter requirements.