Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I lost some notes and i have about 40 minutes before my pc will restart. I know it might be imposible but anyway maybe i will learn something. So the question goes: Is there a RAM trace left by keyboard input that could be recovered in 40 minutes or less. I use Win 7 build 7100. edit: the browser is Chrome, anyone knows how to dump ram RAM? I search but cant find

share|improve this question

migrated from stackoverflow.com May 26 '10 at 19:05

This question came from our site for professional and enthusiast programmers.

    
I search something to dump ram, now. –  user27509 May 26 '10 at 18:55

4 Answers 4

up vote 1 down vote accepted

If you want to see for yourself how impossible this is, download HxD. Go to Extras > Open RAM > chrome.exe > OK, and look around Chrome's memory yourself.

share|improve this answer

I don't think so, since keyboard presses usually pass by the USB and they are handled by the USB controller in a way that is not predictable. There is not direct mapping between a keyboard and the memory.

If you assume that they are stored somewhere in your RAM you should check all the bytes of used RAM without any clues.. not feasible

You should have used something like a keylogger..

share|improve this answer
    
Yeah ,Keylogger would be fine. Is there a of mapping: keyboard->windows-> ram –  user27509 May 26 '10 at 18:59
    
@Chris: A keylogger doesn't do anything after the fact. –  Adam Robinson May 26 '10 at 19:04

Nope, sorry. The only way you can get that level of persistence from a RAM trace is to cryogenically freeze the RAM, and that's only good for about 20 minutes.

share|improve this answer
    
:) so now i got about 38 minutes+20minutes + cost of liquid nitrogen –  user27509 May 26 '10 at 19:02

No, keyboard input does not leave a reliable residue in RAM. While it's possible that the RAM used by the application that crashed (I'm assuming this is what happened) might not yet be overwritten, it's highly unlikely that you'll be able to get anything useful out of it.

share|improve this answer
    
Thanks. I used Chrome browser from google, any clue? –  user27509 May 26 '10 at 19:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.