Acer Aspire netbook with Ubuntu is frozen. What can I do to save temporary data?

Question

I'm in very serious situation. I use Ubuntu 10.10 on my Acer Aspire One netbook. Today it suddenly froze when I was working on something important. It happened after RAM memory and swap became totally full for an unknown reason (they were partially full before).

The mouse and a screen are frozen now, but the hardware seems to be still working: the network and hard disk LEDs are blinking from time to time, but the keyboard is probably not responding. An external USB keyboard doesn't work, although the USB port is giving power.

I know it's a hopeless situation, but maybe there is a chance to save data from swap and RAM if it is still there. I'm thinking about hibernation or getting RAM contents to an external hard disk in some way before I reboot (if it's possible). I'm really desperate, so I would do almost anything. What would help? I would appreciate any kind of help.

Answer 1

The good news is that this is very likely not a serious problem. If you have simply run out of memory, the system will grind to a halt and eventually the OOM killer will step in and start killing processes and you should get your system back.

So, at least for now, the best thing to do is to simply wait and see if your system comes back to you.

---

If you were working on a text editor, you either have one (most really) that takes regular automatic backups so you should be fine or, almost certainly, one that also creates automatic tilde backups. Whenever you save a new version of a text file, most *nix editors will make a backup of the original with a tilde added to its name. So, foo.txt becomes foo.txt~, it is quite likely that not all your work has been lost.

While it may theoretically be possible to somehow extract the data that is stored in your RAM, it will almost certainly take you more time and effort than repeating whatever work it is you have lost.

Answer 2

Maybe only your video output died somehow. Can you get a ping answer? If yes, you could log in remotely an try to save what you can.

Answer 3

Have you tried Ctrl-Alt-F1?

It swaps to a terminal. There you could kill an offending process or dump the document editor's memory - your document may be there, somewhere. To go back to the screen use Ctrl-Alt-F7.

Also, if entirely hopeless: One time I heard of some kind of forensics tool that you reboot your computer, it boots from USB or CD-drive and it dumps the entire RAM to disk, using little memory as possible to not overwrite existing contents. I can't recall the name though, if you search you may find it.

Answer 4

You might (but probably won't) get lucj by using Magic SysRQ Key - see http://en.wikipedia.org/wiki/Magic_SysRq_key - Maybe [alt][fn][sysrq]

Maybe someone else can provide you with a name of software to do it (I can't find it thus far, but this software definately exists), but you might be able to make the memory really, really cold, and then reboot the system and boot from a USB key to dump [some of] the memory to disk. (Possibly what @NothingImpossible was talking about). The software does a "cold boot attack". I did come across this software, but I suspect there are better solutions as this looks pretty difficult as its experimental from 2008. This and then this look like they might be a first step as well [ I've never done a cold boot attack, so I'm only guessing]. Its very much a last-ditch effort and unlikely to be worthwhile.