Glossary term
JTAG Forensics
JTAG stands for Joint Test Action Group, the industry standard for the debug port found on most printed circuit boards. In forensics, JTAG refers to acquiring a forensic image from a device through its manufacturer debug port, without removing the memory chip.
JTAG is a non-destructive advanced acquisition technique. Where a phone cannot be acquired through Cellebrite or Magnet AXIOM, the JTAG debug port on its board can sometimes be used to read the raw flash content directly with a specialized JTAG box.
Common JTAG scenarios include phones that boot but will not unlock, supply-chain or country-locked variants that mainstream forensic tools do not recognize, and devices unsupported by current commercial tools.
JTAG, ISP, and chip-off are the three advanced extraction techniques we operate. JTAG is preferred when the debug port is exposed and the chipset supports it; ISP is preferred when JTAG is unavailable; chip-off is the last resort when both non-destructive options fail.
The technique requires specialised JTAG hardware and trained examiners. We perform JTAG in-house at our Langley lab.