What controller? It could be not typical standard. So if you have known controller with datasheet, measure shorts between memory and controller pads and you find correct pinout.

Thanks for the replies guys. I have just found out that the controller (DM8261) is encrypted. I have found a blog where a data recovery company say they did work out the encryption from the NAND and reversed engineered the XOR after about 2 weeks of work. I might refer this one...

.....and it has been recently confirmed the Appotech DM8261 controller uses XOR in conjunction with AES-256 encryption

I was able to successfully recover the data on the one we received once I figured out the XOR using the encryption key from the original NAND.

interesting.

I don't know the specifics and I would like to believe the DR Engineer figured out the AES-256. It is the wording that bothers me. I want to point out I am not so much doubting the DR guys, but more don't understand how it would be carried out.

First:

I would have thought something along the lines of "we confirmed" or "we discovered" not the vague statement like was used. If someone else did it, a link to their work might have been nice. Anyway a bit strange wording.

Second:

you cannot figure out XOR using an AES-256 encryption key. Unless it is to decrypt dump first, then find XOR (which is not that hard).

I am not going to pretend I know how the data is actually stored using the encryption and XOR, but I do know how others work. And even though there is a huge range of combinations of factors, the actual main aspects are all pretty similar.

to use the encryption key (AES key) there would need to be some kind of decryption, before or after XOR. The XOR key is usually a small block of DATA, say 256 pages, applied to each 256 pages over and over again.

If after, you would need to remove XOR, then break or decrypt AES.

To remove the wear levelling mix you would need to see FAT tables or such, see SA at least, so either data area only is encrypted or there is some other scenario I havent thought of.

If it was encrypted after XOR, even if you found the key, how would you know what algorith you could use to decrypt? After dumping the chip what would be next steps? If you saw an encrypted dump, how would a key be recogniseable?

I am probably not making much sense as I am trying to weigh things up as I reply. All I can come up with is if this is all true, then the blog post is extremely over simplified.

I would love a deeper dive into this.

Been there, done that. https://forum.acelaboratory.com/viewtop ... +52#p32537

Hi guys ,very sorry to disturb this feed ,as this is not related ,but is there any chance for you @fzabkar and @HaQue to PM me ? sorry i relay cant find an another way to contact this two champs
many thanks