JTAG ChipOff for Smartphones Training Program

Mobile devices are among the most ubiquitous electronic communications devices, certainly the fastest growing, and the most frequently encountered. They are encountered at most crime scenes and should be considered when defining the scope of search warrants that include digital evidence.  A great potential exists for encountering valuable evidence on these mobile devices. 

The JTAG Chip Off for Smartphones Training Program (JCSTP) provides advanced forensic techniques for the acquisition and analysis of mobile devices when conventional tools (e.g. Cellebrite, XRY, Oxygen, etc.) fail to acquire the data.

Joint Test Action Group (JTAG) forensics is an acquisition procedure, which involves connection to the Standard Test Access Ports (TAPs) on a device, and instructing the processor to transfer the raw data stored on the connected memory chips (IC). Jtagging supported devices can be an extremely effective technique to extract a full physical image from devices that cannot be acquired by other means.

In-System Programming (ISP) is the practice of connecting to an eMMC or eMCP flash memory chip for the purpose of downloading a device’s complete memory contents. eMMC and eMCP memory are the standard in today’s smartphones, and the ISP practice enables examiners to directly recover the complete data without removing the chip and destroying the device.

Chip-off forensics is an advanced digital data extraction and analysis technique which involves physically removing flash memory chips (IC) from a subject device and then acquiring the raw data using specialized equipment.

Attendees for this program should be experienced mobile device examiners with a fundamental knowledge of forensic procedures and the completion of FLETC’s Mobile Device Investigation Program (MDIP) or equivalent. Successful completion of a practical exercise is required (substantial after hours work may be necessary) for completion of this program. Students must attend each block of instruction and satisfactorily complete all labs and practical exercises of the program in order to receive a Certificate of Training.

The tuition includes state-of-the-art hardware and software, which is issued to each student (which become the property of the student’s agency upon course completion) and will be demonstrated and used during class. The goal of the program is to provide the hardware, software and training to enable the graduate to examine digital evidence immediately upon return to their office. Included in the tuition are these tools, software and ancillary equipment necessary to perform tasks associated with this program.