Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm just curious. I've read about law enforcement and what not recovering incriminating data from ram to get evidence, but how is it done? What kind of equipment would one need to recover files from a stick of ram?

share|improve this question

2 Answers 2

up vote 6 down vote accepted

Freeze the chip, pop it into another computer, and run the linux command dd to copy the raw data to disk.

After you have the raw data, copy it to a new partition using dd again and run an undelete program on the partition. Undelete should pull out any files that fall under a recognizable format (ex pictures, etc...). The rest could be further processed but not easily unless you know what you're looking for.

I can't say that I've done this myself but it's not hard to imagine how it's done.

Check out this video that Daniel Beck posted in the comments to see a demonstration of how to crack hard drive encryptions using this method.

share|improve this answer
3  
That board contains a link to a page on Ed Felten's CITP site with the original research on the topic. –  Daniel Beck Dec 29 '10 at 17:36
    
This is not "Law Enforcment", it's something that can be done under controlled conditions. If you have that kind of access to the computer (a few minutes and some liquid nitrogen) why not keep it from turning off. –  Nifle Dec 29 '10 at 17:38
    
@Nifle There's probably someone with substantial interest in turning his computer off moments before being pinned to a nearby surface. Also, it's rather recent research, and much of that isn't about immediate practical applications. –  Daniel Beck Dec 29 '10 at 17:40
    
@Daniel - Well police is one thing. CSI (the tv-show) is probably the only ones capable of doing what the paper describes outside a laboratory. –  Nifle Dec 29 '10 at 17:42
1  
@Nifle not true. it doesn't take any special tools to accomplish. An air sprayer can (to cool the chip) and a minimal linux install that includes a few necessary (and freely available) tools running on a usb drive or separate computer is all it takes. –  Evan Plaice Dec 29 '10 at 17:50

You can't (in practice). RAM needs to be constantly refreshed to keep "remembering", when the computer is turned off the charge leaks out after a minute or so.

Form wikipedia

Dynamic random access memory (DRAM) is a type of random access memory that stores each bit of data in a separate capacitor within an integrated circuit. Since real capacitors leak charge, the information eventually fades unless the capacitor charge is refreshed periodically. Because of this refresh requirement, it is a dynamic memory as opposed to SRAM and other static memory.

The main memory (the "RAM") in personal computers is Dynamic RAM (DRAM), as is the "RAM" of home game consoles (PlayStation, Xbox 360 and Wii), laptop, notebook and workstation computers.

The advantage of DRAM is its structural simplicity: only one transistor and a capacitor are required per bit, compared to six transistors in SRAM. This allows DRAM to reach very high densities. Unlike flash memory, it is volatile memory (cf. non-volatile memory), since it loses its data when power is removed. The transistors and capacitors used are extremely small—millions can fit on a single memory chip.

share|improve this answer
2  
The keyword is "eventually". This research paper citp.princeton.edu/memory shows that RAM keeps its contents for a few seconds to a few minutes after it loses power, even after it is removed from the motherboard, which is long enough for an attacker with physical access to the machine. –  j-g-faustus Dec 29 '10 at 17:42
1  
@Nifle If it's locked you won't be see what files the user is currently using. You could restart it and (if you're using windows) hack your way around the password but only if the drive isn't encrypted. With the right tools and a freshly plucked ram chip, you can even crack the hard drive encryption key by reading the ram. In the fields of security and forensics, these little techniques can be extremely useful. –  Evan Plaice Dec 29 '10 at 17:48
1  
@Nifle To place it in a controlled environment and prevent software on that system from running. Basically the same reason they don't start your machine, but take the hard drive and dump its contents first. –  Daniel Beck Dec 29 '10 at 17:49
1  
@Evan The source for your comment. –  Daniel Beck Dec 29 '10 at 17:50
3  
@Evan - I still think it's more "normal situations" the OP is referring to. "The cops show up and take your computer." and not "Seconds after you shut your computer the DHS storms your apartment and a few seconds later they have your computer dismantled in their portable RAM extraction lab" –  Nifle Dec 29 '10 at 17:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.