JTAG
Definition
Joint Test Action Group standard (IEEE 1149.1) for chip-level debugging. The test access port left on a phone's PCB lets a forensic tool read the NAND through the SoC without removing the chip. Soldering forensic adapters to test points on the board is the practical entry point.
- Standard
- IEEE 1149.1
- Full name
- Joint Test Action Group
- Pin count
- Minimum four (TCK, TMS, TDI, TDO)
- Common forensic tools
- SEGGER J-Link, Bus Pirate
Common questions
What is JTAG used for in forensics?+
JTAG is a standardized debug interface that lets forensic tools read data directly from a device's memory chips without removing them. On phones, it accesses the NAND storage through the SoC. On IoT devices, it halts the CPU and dumps RAM or flash memory.
How do you access JTAG on a device?+
You solder forensic adapters to test points (TCK, TMS, TDI, TDO pins) on the circuit board. Tools like SEGGER J-Link or Bus Pirate connect to these solder points to communicate with the chip and read its data.
What's the standard behind JTAG?+
JTAG is defined by IEEE 1149.1, the Joint Test Action Group standard. It was designed as a boundary-scan interface for chip-level debugging and testing.
Related terms
- Binwalk
- An open-source firmware analysis tool that scans a binary blob for known file signatures (squashfs, JFFS2, gzip, LZMA, certificates) and extracts the...
- Cellebrite UFED
- Cellebrite Universal Forensic Extraction Device. The dominant commercial mobile forensics platform in Indian state cyber cells and at CFSL Hyderabad. Combines acquisition...
- Chip-Off
- NIST SP 800-101 R1 Level 5 acquisition. Desoldering the NAND or eMMC chip from the PCB and reading it directly with a...
- CoAP
- Constrained Application Protocol (RFC 7252). A RESTful protocol over UDP on port 5683 (or 5684 with DTLS), designed for constrained devices that...
- DPDP Act 2023
- Digital Personal Data Protection Act 2023. India's general data protection statute, in force in phases from 2024. Applies to IoT-collected personal data...
- eMMC Dump
- Embedded Multi-Media Card flash chip extraction. The chip is desoldered (chip-off) or read in-circuit with an ISP adapter; the raw NAND or...
- Faraday Bag
- A signal-blocking pouch with conductive mesh lining that prevents cellular, Wi-Fi, Bluetooth and NFC signals from reaching a seized phone. The standard...
- Logical Extraction
- NIST SP 800-101 R1 Level 2 acquisition. Uses the OS-exposed backup APIs (Android ADB backup, iOS iTunes/Finder backup, MTP for media) to...
- MQTT
- Message Queuing Telemetry Transport. A publish/subscribe protocol on TCP port 1883 (plain) or 8883 (TLS) with a central broker. Designed for low-bandwidth...
- Physical Extraction
- An acquisition method that reads the raw storage medium, producing a bit-for-bit image from which allocated and deleted data can both be...
- UART
- Universal Asynchronous Receiver/Transmitter. A two-wire serial interface (TX, RX, GND, optional VCC) exposed on most IoT device boards as debug pads or...
Explained in these topics
- IoT Forensics: Smart Home, Wearables, MQTT/CoAP and Firmware AnalysisJoint Test Action Group boundary-scan interface (IEEE 1149.1). A four-pin (TCK, TMS, TDI, TDO) or larger debug interface that lets a tool such as the SEGGER J-...
- Mobile Phone Forensics: Acquisition, JTAG and Chip-OffJoint Test Action Group standard (IEEE 1149.1) for chip-level debugging. The test access port left on a phone's PCB lets a forensic tool read the NAND through...