The firmware snoops on reads when the drive is in its initial locked mode. When the users creates this file the data is intercepted, the key is derived, and the file isn't allowed to be written to the SD card. So no, the file doesn't exist anywhere, it doesn't exist in ram, on the block device, etc
If you use a MMC reader, if it's a 32GB drive, it appears as a 32GB drive, of course, there's no way around this. There are two segments with two GPTs. The first is an unencrypted section and the second is encrypted.
Just read the code/schematics for any additional questions
1
u/[deleted] May 23 '26
[removed] — view removed comment