Data scramblers in today's NAND flash-based solid-state drives (SSDs) randomize stored bit patterns to mitigate pattern-dependent errors, improve data retention, and increase error-correcting code (ECC) effectiveness. Despite their importance and widespread use, the on-die scrambling mechanisms and keys remain proprietary and opaque to system designers, tool builders, and forensic analysts. This paper presents the first experimental demonstration of scrambling key extraction from unmodified commercial-off-the-shelf (COTS) NAND flash chips. By manipulating page write operations to force all cells into a known physical state, we successfully recover the underlying scrambling keys without any vendor support or controller modification. The extracted keys exhibit consistent structural patterns across devices, typically 16–64 bytes depending on the NAND technology, and repeat periodically before transitioning to new sequences. The keys are page-dependent, block-independent, and consistent across chips of the same part number, enabling full reconstruction from a single block or device. Our results demonstrate the generality of the method across both single-level cell (SLC) and multi-level cell (MLC) NAND flash architectures. The ability to reconstruct scrambling keys from raw NAND enables controller-independent reliability analysis, validation of instant data-sanitization schemes, and higher-fidelity forensic reconstruction from raw memory dumps.