0

My computer has been acting funny lately (I think my $30 motherboard is going out). However something that really confused me happened just now.

I'm running a Windows 10 and Linux dual boot. Some examples of strange behaviors of my computer are:

  • Sometimes it doesn't shut down, it just pretends to and hops right back into the login screen.
  • It doesn't go to sleep either
  • My CMOS battery has mysteriously disappeared. (lol)
  • The real purpose of this question, the fact that some video cache from Windows seems to have leaked into Linux.

I was in Windows, and I hit restart from the start menu, and as I was booting up my Linux build, and between the login screen popping up and the X server console (?) showing, a flash of a screen capture of Steam from my Windows build popped up.

By the way, when I say screen capture, I don't mean I took a screenshot. It was just an random view of my computer screen when Steam happened to be in focus.

4
  • what kind of video card do you have? is it integrated into the motherboard?
    – cybernard
    Apr 6, 2016 at 0:32
  • 3
    Most likely what you saw was just some left over data sitting in your video card's ram that was briefly shown after switching video modes, but before X drew to the video memory.
    – psusi
    Apr 6, 2016 at 0:41
  • @psusi That's what I expected, but I thought that data from the RAM was wiped once it lost power. Does RAM not lose power on a soft reboot? Apr 6, 2016 at 2:30
  • RAM does not lose power during a reboot.
    – psusi
    Apr 6, 2016 at 23:18

1 Answer 1

1

You are assuming RAM wipeout upon poweroff is immediate, i.e. infinitely fast. Though this is a widespread belief, it is not true: this Princeton Univ. paper shows that data is retained potentially for many seconds, occasionally even several minutes. Let me quote:

Abstract Contrary to popular assumption, DRAMs used in most modern computers retain their contents for seconds to minutes after power is lost, even at operating temperatures and even if removed from a motherboard. Although DRAMs become less reliable when they are not refreshed, they are not immediately erased, and their contents persist sufficiently for malicious (or forensic) acquisition of usable full-system memory images. We show that this phenomenon limits the ability of an operating system to protect cryptographic key material from an attacker with physical access. We use cold reboots to mount attacks on popular disk encryption systems — BitLocker, FileVault, dm-crypt, and TrueCrypt — using no special devices or materials. We experimentally characterize the extent and predictability of memory remanence and report that remanence times can be increased dramatically with simple techniques. We offer new algorithms for finding cryptographic keys in memory images and for correcting errors caused by bit decay. Though we discuss several strategies for partially mitigating these risks, we know of no simple remedy that would eliminate them.

This paper is widely quoted, and has given rise to a new form of attack called a cold boot attack. Googling this expression will show you a rather vast set of articles about its dangers. You will also find academic papers like this one from Penn. State U. further discussing the same topic.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .