Forensic imaging of embedded systems using JTAG (boundary-scan)

This paper describes how to use JTAG (JTAG: Joint Test Action Group, also called boundary-scan) for producing a forensic image (image: an one-on-one copy of data found on an exhibit) of an embedded system. A JTAG test access port is normally used for testing printed circuit boards or for debugging embedded software. The method described in this paper uses a JTAG test access port to access memory chips directly. By accessing memory chips directly, the risk of changing data in the exhibit is minimized. Also user level passwords can be omitted.