I lost some notes and i have about 40 minutes before my pc will restart. I know it might be imposible but anyway maybe i will learn something. So the question goes: Is there a RAM trace left by keyboard input that could be recovered in 40 minutes or less. I use Win 7 build 7100. edit: the browser is Chrome, anyone knows how to dump ram RAM? I search but cant find

  • I search something to dump ram, now. – user27509 May 26 '10 at 18:55

If you want to see for yourself how impossible this is, download HxD. Go to Extras > Open RAM > chrome.exe > OK, and look around Chrome's memory yourself.


No, keyboard input does not leave a reliable residue in RAM. While it's possible that the RAM used by the application that crashed (I'm assuming this is what happened) might not yet be overwritten, it's highly unlikely that you'll be able to get anything useful out of it.

  • Thanks. I used Chrome browser from google, any clue? – user27509 May 26 '10 at 19:05

Nope, sorry. The only way you can get that level of persistence from a RAM trace is to cryogenically freeze the RAM, and that's only good for about 20 minutes.

  • :) so now i got about 38 minutes+20minutes + cost of liquid nitrogen – user27509 May 26 '10 at 19:02

I don't think so, since keyboard presses usually pass by the USB and they are handled by the USB controller in a way that is not predictable. There is not direct mapping between a keyboard and the memory.

If you assume that they are stored somewhere in your RAM you should check all the bytes of used RAM without any clues.. not feasible

You should have used something like a keylogger..

  • Yeah ,Keylogger would be fine. Is there a of mapping: keyboard->windows-> ram – user27509 May 26 '10 at 18:59
  • @Chris: A keylogger doesn't do anything after the fact. – Adam Robinson May 26 '10 at 19:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.