The attack used on regular AT PCs with encrypted-at-rest boot disks but no TPM, is that DIMMs of DRAM can be popped out and immediately put into a specialized b

The attack used on regular AT PCs with encrypted-at-rest boot disks but no TPM, is that DIMMs of DRAM can be popped out and immediately put into a specialized board that will keep them refreshed while scanning them (but cannot write to them.) As long as the encryption key is in plaintext in RAM, this allows you to recover it. (Also, before you remove the DIMMs, you can get the RAM + its board very cold, to decrease the decay rate during the swap.) Popular hardware NAS appliances might have all their RAM soldered on-board or part of an SoC die, but they still don't tend to have TPMs, nor an IOMMU (critical for limiting DMA rights by peripheral.) So accessing the keys on these is only a little bit more fiddly — either involving hijacking the address + data bus between the CPU and RAM; or, easier and more universal to modern devices, by putting a specialized PCI peripheral device onto the NAS's peripheral bus, that then dumps RAM by requesting DMA transfers to itself.