A mathematical approach to NAND flash-memory descrambling and decoding

New mathematical techniques for analysis of raw dumps of NAND flash memory were developed. These techniques are aimed at detecting, by analysis of the raw NAND flash dump only, the use of LFSR-based scrambling and the use of a binary cyclic code for error-correction. If detected, parameter values for both LFSR and cyclic error-correcting code are determined simultaneously. These can subsequently be applied to expose the content of memory pages in the raw NAND flash dump and prepare these for further processing with media analysis tools. The techniques were tested on raw NAND flash memory dumps of four different devices and in all cases LFSR-based scrambling and binary cyclic error-correcting codes were in use.