## 2 Related Works and State of the Art Review
### Related Works
#### 2.7.2 Acquisitions Using ISP, JTAG, and Chip-Off  
[PERSON] [9] conducted a study focused on JTAG and ISP physical acquisition techniques to prove that these forensic techniques are equivalent when compared to any other method. To this end, he proposed three tests. The first test showed the differences in the results of the forensic analysis when performing a physical acquisition, file system, and logical acquisition, using UFED Touch, and later comparing the results using the Physical Analyzer. The results revealed that the physical extraction is more potent and, in forensic terms, retrieves a larger quantity of evidence. The second test [9] aimed to prove that all physical acquisitions are equivalent, comparing the data acquired from the same device using UFED Touch and the \"dd\" tool. The result showed that there was a difference in the hash of two files; however, the author explains that the differences in \"user data\" are due to unallocated space and changes in the \"File System\" files, such as \"inode table\" and \"superblock.\"  
The third test [9] consisted of examining the content of an encrypted device to show whether it is possible to find evidence, which was acquired using the \"dd\" tool, verifying whether physical acquisition of an encrypted device can provide any useful information. It was concluded that if the device is encrypted, the physical acquisition will produce a complete encrypted code, useless for forensic analysis because no information that makes sense can be found. In the case of old or outdated Android devices, there is the possibility of breaking the encryption. The author [9] also describes a step by step guide to acquiring a mobile device using ISP and JTAG and its subsequent analysis in the UFED Physical Analyzer. The author [9] also sought to highlight the diverse degrees of difficulty when using different tools, such as UFED Touch, which is easy to use,comparing it to ISP and JTAG, with which there is a risk of damaging the device. The main focus of the study was to provide an overview of the acquisition of JTAG and ISP, and present some information about these techniques and to show that the UEFD Physical Analyzer can read the extraction product. In the study [9], the device used for data acquisition in the experiment was a rooted Samsung GT-I9505 (Galaxy S4) with Android OS Version 5.0.1, with encrypted main memory, and a Nokia Lumia 635, with Windows Phone 8.1. [PERSON] and [PERSON] [45] conducted a comparative study of requirements, capabilities, and limitations of forensic techniques for the logical and physical acquisition of data from mobile devices, using a Samsung Galaxy Grand Duos GT-I9082 device to perform the comparative tests. The following suites and forensic tools were analyzed: UFED, MOBILedit, Oxygen Forensics and XRY, ADB Pull, Backup Analysis, AFLogical, Wondershare Dr. Fone for Android, JTAG, and Chip-Off. Although they address the use of JTAG and Chip-Off, the analyzed device was launched with Android OS Version 4.1.2 and was updated until version 4.2.2, both did not provide, by default, the main memory encryption. [PERSON] et al. [46] analyzed seven m-banking apps for Android in Thailand and described the forensic artifacts that can be recovered, as well as the results of the applications' assessment concerning security. They describe JTAG as a physically invasive data acquisition method, but that allows access to data without the need for USB debugging enabled, or without the enabled root user (without root) and still circumvent password lock, bypassing the OS security mechanism. In the experiment, a rooted Samsung GT-I9500 (Galaxy S4) and a non-rooted Samsung GT-I9190 (Galaxy S4 Mini) were used, both with Android OS in Version 4.4.2 with unencrypted main memory. On 28 January 2020, NIST released the results of tests performed using JTAG and Chip-Off to acquire data from damaged mobile devices [47]. The objective was to test the validity of the methods; to see if they produce accurate results with reliability.