1

Would there by some way to pull the power instead of conventional shut down, and recover the contents of ram without loading the operating system upon the next start-up? I'm trying to recover files open on an unresponsive Ubuntu live cd.

Update:

I read the paper suggested by Alex and I think that's probably my best bet. Like Dan D said, you don't need liquid nitrogen, the paper itself suggests dust cleaner fluid in those cans to lower the temperature. I'll give it a try and post the results here. If anyone has any suggestions, please let me know.

From what I gathered from the paper, I lower the RAM's temperature to around -50 degrees before cutting power, cut power, boot a modified program supplied by the paper's authors from a USB stick, which then dumps the RAM's contents to the USB.

10
  • Ram is completely cleared. Why are you asking the same question more than once? See my comment on your next question.
    – Xavierjazz
    Aug 12, 2014 at 1:27
  • I updated the other question. Thanks for your help. The two questions were different, but if it isn't allowed to ask questions like this, I'll delete one.
    – Rayman
    Aug 12, 2014 at 1:33
  • The question may be phrased differently. but its the same question, isn't it?
    – Xavierjazz
    Aug 12, 2014 at 1:34
  • They are similar I see what you mean. Do you have any suggestions to how I could recover the contents of my RAM? Also, should I delete this question?
    – Rayman
    Aug 12, 2014 at 1:36
  • 1
    RAM contents may persist for a few seconds, maybe a minute or so. But there's no practical way, on a conventional box, to get at the RAM contents after power has been taken away. Aug 12, 2014 at 3:08

2 Answers 2

2

The only way that would work is if you had access a very cold liquid such as liquid helium or liquid nitrogen.

Here is a paper on the topic: Lest We Remember: Cold Boot Attacks on Encryption Keys

2
  • No need to cool that much, an upside down Dust-off can (dimethyl ether) is more than sufficient as they show in figure 5 of Lest We Remember: Cold Boot Attacks on Encryption Keys.
    – Dan D.
    Aug 12, 2014 at 2:19
  • So should I go ahead and try this technique? Is it my best chance?
    – Rayman
    Aug 12, 2014 at 22:23
0

The short answer is yes. RAM will lose its contents with a loss of power.

As Alex mentioned in his answer, there are methods of reading the contents of RAM after power loss by cooling the RAM. However, the contents are not 100% recoverable; data will be lost. In addition to that, these cold boot attacks require special equipment to read the contents of the RAM without overwriting it.

Not the answer you're looking for? Browse other questions tagged .