Free Mobile JTAG Training and Tools

Visitors to trewmte.blogspot.com may recall a discussion thread posted back in 2012 regarding a JTAG Tutorial http://trewmte.blogspot.co.uk/2012/09/jtag-tutorial.html. The purpose of that thread was to enable students, newcomers and experienced mobile/smart phone examiners to get a feel for JTAG before undertaking such examinations or purchasing tools etc.

Today, Kevin Swartz from www.nowsecure.com has released a FREE three-part training course specifically for JTAGing smart phones. Kevin has dropped a line to me saying "Hi Greg, yes, please feel free to link to any of our free resources pages: https://www.nowsecure.com/resources/".

The FREE three-part training course:

PDF Download: https://www.nowsecure.com/resources/jtag-forensics-training/

JTAG 101 videos:
https://www.youtube.com/playlist?list=PLkotz0CYBQDrXpvO0UZlmrUpQLtegPgWI

JTAG 102 videos:
https://www.youtube.com/playlist?list=PLkotz0CYBQDp_YMS_jMXSjKsvgWtL8e_p

Thanks Kevin. You're a decent chap for your kind gesture to help out students, newcomers and experienced examiners in the community.

Presentation JTAG and Boundary Scan

Informative 30-min presentation on "What is JTAG and Boundary Scan?" by EEVblog:

Chip Off, JTAG, NAND and YAFFS2

Chip Off, JTAG, NAND and YAFFS2

An article and a presentation identifying practices and concepts. Both contain add-value content with respect to the subject matter

Practitioner's view of Chip Off and JTAG

http://db.tt/ybQFitvS

Raw NAND flash and the YAFFS2 file system

http://db.tt/B379qsYM

Mobile Flash Data Erasure

Mobile Flash Data Erasure

                                                  Photo courtesy of Blancco

The growth in smart phones naturally means consumers will see even more utilities and tools similiar to those found on PCs, laptops and notebooks etc. A trend that is growing in relation to cleansing of personal details and company information stored logically and physically is called mobile flash data erasure (MFDE).

Service erasure
A group called www.tabernus.com/ promote "Tabernus also provides erasure solutions for Mobile Phones, USB, SSD (solid state devices) & other types of Flash removable memory and may other data holding devices too!"

Software erasure
Of course, there is a comparison for mobile phone flash erasure available from  http://www.blancco.com/us/erase-smartphones/

The above examples are in addition to hardware encryption:

Device specific denied data access
Hardware Encryption: The iPhone 3GS and later, and all iPads, support built-in hardware encryption. All user data can be automatically encrypted in hardware at all times. This is used primarily for wiping the device rather than to stop attacks. Erasing the entire flash storage would be slow, so instead wiping works by destroying the encryption key, which instantly makes all user data inaccessible (Securosis).

And flash memory management:

Flash Memory Management Systems
Wear leveling ( http://en.wikipedia.org/wiki/Wear_leveling ) as well routines used in garbage collection solutions ( http://en.wikipedia.org/wiki/Garbage_collection_%28SSD%29#Garbage_collection and http://en.wikipedia.org/wiki/Garbage_collection_%28computer_science%29 ) can lead to potential loss due to overwriting existing deleted data.

From an examiner's point of view, MFDE is most likely to have a huge impact on deleted data recovery (DDR) from flash chips. The methodology and science behind Chip Off and JTAG is currently used for recovery of deleted data from a  range of mobile devices. Overwriting 0101010101 (zeros and ones) or null values over particular areas or the entire area of the flash memory may make Chip Off and JTAG redundant in certain types of investigations and cases in the future.

iPhone Secret Folder

iPhone Secret Folder

Opening the taps on this one could prove useful:

 

https://itunes.apple.com/us/app/secrets-folder-pro-lock-your/id566516598?mt=8

JTAG Tutorial

JTAG Tutorial 

Certain mobile phones have no other access capability other than a test interface to allow for debugging and memory analysis capability other than to use JTAG (Joint Test Action Group) standard: IEEE 1149.1 : 1990 Standard Test Access Port and Boundary-Scan Architecture. IEEE 1149.1 : 2001 is available here: http://standards.ieee.org/findstds/standard/1149.1-2001.html   

There are various reading materials available by way of the internet that help an examiner understand the way in which JTAG can be used: 

http://www.corelis.com/education/JTAG_Tutorial.htm

What is JTAG?
Overview of the JTAG architecture and the new technology trends that make using JTAG essential for dramatically reducing development and production costs. The article also describes the various uses of JTAG and the tools available today for supporting JTAG technology.

Additional material: http://en.wikipedia.org/wiki/Joint_Test_Action_Group

Other materials that may interest:

Mobile Phone Chip Off - http://trewmte.blogspot.com/2011/02/mobile-phone-chip-off.html 

Mobile device forensics - http://en.wikipedia.org/wiki/Mobile_device_forensics

JTAG acquisition from Android - http://www.caseite.com/content/jtag-acquisition-android

Is JTAG forensically approved? - http://www.forensicfocus.com/Forums/viewtopic/p=6533275/