I have the same desire to backup all my Samsung Memo data in plain text on my computer. I also used Samsung Smart Switch (using default settings) to transfer the information to my computer, then found there was an opaque
memo.zip and found I could extract the archive successfully.
This extraction output three files:
The JSON file is plain-text, but doesn't seem to contain Memos. I assume that the other files are encrypted, because I couldn't read them. I assumed that
exml stands for "encrypted xml", so it's probably possible to brute force the decryption key by searching for the
<?xml version=" string.
It seems the researchers here had a similar idea. They apparently developed a decryption tool as published here but the full-text PDF is not available for public download. Sadly, I could find any public tool that decrypted my local data (I did try this but the most recent software did not work as claimed - perhaps an older version of the software might do what the article says, but I didn't pursue that - yet).
However, realising that the publications by the researchers above showed that there's both PIN-based and default encryption for the backups (both happen on the phone before the data is transmitted to the computer, as per their diagrammes), I realised I should actually look at the Smart Switch settings to see if there's a way to remove the encryption settings.
On the phone, open Samsung Smart Switch app.
Press the vertical-ellipsis "kebab" menu:
which takes you to
Smart Switch Settings.
Under the Security heading, there is an External storage encryption option which contains:
- Secure with Samsung Account
- Secure with password
- No encryption
I changed the setting from the first option to the last option and ran Smart Switch backup again.
Sadly, it doesn't seem to have made the files much easier to read. It still outputs the opaque
memo.nmmm archive and that still extracts the same three files, with the same file sizes each. Between the first encrypted output and the second unencrypted output, I ran a binary diff on the
SSMDummyValue.exml files. The
memo.bks are completely different, but the
SSMDummyValue.exmls are the same except for the last third of the file. The
SmartSwitchBackup.json files didn't text-diff well until I auto-formatted them and then it was obvious they were identical.
So, my remaining options are
- wait for the authors of this to respond to my request for the full PDF (but I am not with any institution, so someone else might have better chances) to see if it contains any software that may help decrypt the Memo files
- try to obtain an older version of this software, perhaps by contacting those forensics experts
- try to brute force decrypt the
SSMDummyValue.exml file using the encryption methods mentioned in the aforementioned forensics publications
All of these options take more time than I have right now, so I thought that I would post my current findings here in case it helps someone reach the next steps. I will update my answer later when I have found a more full solution.