I'm just curious. I've read about law enforcement and what not recovering incriminating data from ram to get evidence, but how is it done? What kind of equipment would one need to recover files from a stick of ram?
Add a comment
|
3 Answers
Freeze the chip, pop it into another computer, and run the linux command dd to copy the raw data to disk.
After you have the raw data, copy it to a new partition using dd again and run an undelete program on the partition. Undelete should pull out any files that fall under a recognizable format (ex pictures, etc...). The rest could be further processed but not easily unless you know what you're looking for.
I can't say that I've done this myself but it's not hard to imagine how it's done.
Check out this video that Daniel Beck posted in the comments to see a demonstration of how to crack hard drive encryptions using this method.
answered Dec 29, 2010 at 17:35
-
3That board contains a link to a page on Ed Felten's CITP site with the original research on the topic.– Daniel Beck ♦Dec 29, 2010 at 17:36
-
This is not "Law Enforcment", it's something that can be done under controlled conditions. If you have that kind of access to the computer (a few minutes and some liquid nitrogen) why not keep it from turning off.– NifleDec 29, 2010 at 17:38
-
@Nifle There's probably someone with substantial interest in turning his computer off moments before being pinned to a nearby surface. Also, it's rather recent research, and much of that isn't about immediate practical applications.– Daniel Beck ♦Dec 29, 2010 at 17:40
-
2@Nifle not true. it doesn't take any special tools to accomplish. An air sprayer can (to cool the chip) and a minimal linux install that includes a few necessary (and freely available) tools running on a usb drive or separate computer is all it takes. Dec 29, 2010 at 17:50
-
1But if you boot the computer with the ram, wouldn't that erase everything on it during POST?– steiniDec 30, 2010 at 14:02
You can't (in practice). RAM needs to be constantly refreshed to keep "remembering", when the computer is turned off the charge leaks out after a minute or so.
Form wikipedia
Dynamic random access memory (DRAM) is a type of random access memory that stores each bit of data in a separate capacitor within an integrated circuit. Since real capacitors leak charge, the information eventually fades unless the capacitor charge is refreshed periodically. Because of this refresh requirement, it is a dynamic memory as opposed to SRAM and other static memory.
The main memory (the "RAM") in personal computers is Dynamic RAM (DRAM), as is the "RAM" of home game consoles (PlayStation, Xbox 360 and Wii), laptop, notebook and workstation computers.
The advantage of DRAM is its structural simplicity: only one transistor and a capacitor are required per bit, compared to six transistors in SRAM. This allows DRAM to reach very high densities. Unlike flash memory, it is volatile memory (cf. non-volatile memory), since it loses its data when power is removed. The transistors and capacitors used are extremely small—millions can fit on a single memory chip.
-
5The keyword is "eventually". This research paper citp.princeton.edu/memory shows that RAM keeps its contents for a few seconds to a few minutes after it loses power, even after it is removed from the motherboard, which is long enough for an attacker with physical access to the machine. Dec 29, 2010 at 17:42
-
2
-
6@Nifle If it's locked you won't be see what files the user is currently using. You could restart it and (if you're using windows) hack your way around the password but only if the drive isn't encrypted. With the right tools and a freshly plucked ram chip, you can even crack the hard drive encryption key by reading the ram. In the fields of security and forensics, these little techniques can be extremely useful. Dec 29, 2010 at 17:48
-
2
-
6@Evan - I still think it's more "normal situations" the OP is referring to. "The cops show up and take your computer." and not "Seconds after you shut your computer the DHS storms your apartment and a few seconds later they have your computer dismantled in their portable RAM extraction lab"– NifleDec 29, 2010 at 17:59
DRAM cells store electrical charges. They are leaky, so as was mentioned, they need to be refreshed.
There are manufacturing tolerances, and the influence of temperature and component age, that will define the ACTUAL time it takes for a DRAM cell to be no longer readable reliably if it has not been refreshed. The refresh specification for a given DRAM chip will actually be a worst case value - something that will keep your data readable with monday-production chips that have been running at maximum temperature for 20 years more or less. In most cases, the cell can keep the data far longer.
In addition, the circuitry inside a DRAM chip decides whether to read the amount of charge in a given cell as "0" or "1" (in some designs, that might be reversed - low charge means "1"). Charge content that is not high enough to be read as "1" is still in the cell - and in some cases, by running the DRAM chip with an out-of-spec operating voltage (which might stress it, or make it far slower, but will not yet destroy it), the threshold voltage on which 1 is decided from 0 can be manipulated temporarily, so some or all cells become readable again.
Also, unless there is actually an output register, there might be subtle voltage or waveform differences even in the quantized (switched to 1 or 0) output signal that can give you a hint at what charge is actually in the cell - comparators (which read amplifiers are) are rarely perfect quantizers, especially if they are built for speed not precision.
Also, if a cell reads unreliably, a determined attacker or forensicist can still use statistics to his advantage (count how many times a 0 or 1 is read, and correlate)...
