Use case
When a phone is damaged or locked, evidence is still recoverable.
Conventional Cellebrite acquisitions stop at the boundaries of the tool. We go further with chip-off, JTAG, and ISP extraction, performed in-house at our Langley main office.
Signs you may need this
Common indicators we hear from counsel and corporate clients.
- Phone is locked and password is unknown
- Device is physically damaged or water-affected
- Device boots but tools cannot acquire it
- Storage media has logical corruption
- Standard forensic tools have failed
Advanced extraction techniques
Chip-off, JTAG, and ISP — when standard tools fail.
Chip-off forensics. Physically desoldering the eMMC, eMCP, or NAND memory chip from the phone's logic board, then reading the raw flash directly with a specialized programmer. Used when a device is severely damaged or non-functional. Destructive to the device but often the only way to recover evidence from catastrophic-damage phones.
JTAG (Joint Test Action Group) forensics. Acquiring a forensic image through the device's debug port, accessed via test access points on the printed circuit board. Non-destructive to the device. Used for phones that boot but will not unlock, supply-chain or country-locked variants, and devices unsupported by mainstream forensic tools.
ISP (In-System Programming) forensics. Accessing the eMMC test points directly on the board, often a faster and less invasive alternative to chip-off. Non-destructive. Used for damaged or locked devices when JTAG ports are unavailable or unsupported by the chipset.
These techniques require microscope work, board-level rework equipment, manufacturer flash programmers, and trained examiners. We have all three in-house at our Langley main office.
How we approach it
A defensible, repeatable process.
We never recommend a destructive technique without exhausting non-destructive options first.
- Assess the device at intake. Record the model, chipset, condition, and any prior repair work.
- Attempt conventional acquisition through Cellebrite or Magnet AXIOM where feasible. Many "locked" devices yield to current tools.
- Attempt ISP extraction where the test points are exposed and the chipset supports it. Non-destructive.
- Attempt JTAG extraction where the debug port is accessible and the chipset supports it. Non-destructive.
- Recommend chip-off only when non-destructive options have been ruled out and the matter justifies destruction of the source device.
We give counsel a written feasibility opinion before any destructive work begins. The decision to authorize chip-off rests with counsel and the client.
What we deliver
Concrete outputs from a typical engagement.
- 01
Advanced acquisition: chip-off, JTAG, or ISP
- 02
Extraction of available user data
- 03
Physical preservation of the device
- 04
Examiner report explaining technique used
- 05
Honest assessment when recovery is not feasible
- A written feasibility opinion at intake describing the technique recommended, the destructiveness implications, and the timeline.
- A forensic image of the device (where the technique permits a full image), hash-verified.
- A written examiner report covering the acquisition method, the methodology, and the findings.
- An expert affidavit if the matter requires sworn evidence about the acquisition.
- A chain-of-custody record from intake through archive.
Services typically engaged
Forensic services we draw on for this scenario.
Mobile Forensics
iOS and Android extraction including chip-off, JTAG, and ISP techniques for damaged or locked devices that conventional tools cannot read.
Learn moreComputer Forensics
Forensic imaging and analysis of Windows, macOS, and Linux systems for litigation, internal investigations, and expert witness work.
Learn moreExpert Witness
Court-qualified expert witnesses delivering affidavits, expert reports, and trial testimony in Canadian civil and criminal matters.
Learn moreCommon questions
Damaged or Locked Device questions we hear most.
Will my phone be destroyed?
Only if chip-off is the right technique for your matter, and only with your written authorization. Most damaged-device cases do not require chip-off. We assess at intake and give a feasibility opinion before any destructive step.
How much can be recovered from a water-damaged phone?
Often a great deal. Water damage usually destroys the device's ability to power on but leaves the memory chip intact. Chip-off extraction reads the chip directly, recovering nearly the full data partition in many cases.
How much can be recovered from a fire-damaged phone?
It depends on whether the memory chip survived. Severe heat can destroy the silicon. Moderate heat damage often leaves the chip readable. We assess at intake.
Can JTAG and ISP unlock a passcode?
Not directly. JTAG and ISP recover the encrypted data partition. Decryption depends on the device's encryption model and the availability of the unlock credential or recovery key. For modern iOS devices with secure-enclave encryption, JTAG and ISP do not bypass the lock screen on their own.
How long does an advanced extraction take?
ISP and JTAG extractions typically complete in one to three business days from intake. Chip-off can take three to seven business days due to desoldering, reading, and reassembly steps.
How much does it cost?
Cost depends on the technique and the device. We give a written estimate at scoping after the feasibility assessment. We do not begin work without authorization against that estimate.
Related scenarios
Other use cases that often arise alongside this one.
Have a damaged or locked phone that needs forensic recovery?
Tell us about the device and the matter. Our team will reach out as soon as possible.