And yes, you can do a full block copy - with the cooperation of the OS - if you know the back door. A lot of these Border Patrol devices depend on it.
(1) It is almost certain that JTAG is not exposed on an iPhone, as this would be a massive and obvious error on Apple's part, though I do not actually have proof of this.
(2) No type of debug interface is exposed via the dock connector, as this would also be a massive security hole. Rather, as previously stated, imaging software uses exploits, often for bugs previously found by jailbreakers and since patched. (Note that people have used the kernel debugger over the serial interface on some dock connector pins, but only as a convenience after exploiting the kernel to enable this functionality. It is normally disabled.)
(3) A raw block copy of the NAND is useless, because the data is encrypted using the UID key hidden in the hardware AES engine.
(4) Even if you get an exploit running, some information (sensitive information minus the information that's required for operation while locked) is encrypted with the passcode. You can bruteforce the passcode, the process of testing a particular passcode requires using the aforementioned UID key, which you can only ask the hardware AES engine to encrypt and decrypt things with, not actually retrieve. Therefore, without some really powerful hardware attacks, bruteforcing must be conducted at a fixed rate on the phone itself, rather than offline on a compute cluster. If you use a 4 digit passcode, this isn't much help, since it doesn't take long to try 10,000 possibilities, but a good password will take a long time to bruteforce.
Not perfect - among other things, as previously mentioned, you're screwed if they also have the computer you sync the phone with - but not bad.
See: http://images.apple.com/iphone/business/docs/iOS_Security_Oc...