I'm in very serious situation. I use Ubuntu 10.10 on my Acer Aspire One netbook. Today it suddenly froze when I was working on something important. It happened after RAM memory and swap became totally full for an unknown reason (they were partially full before).

The mouse and a screen are frozen now, but the hardware seems to be still working: the network and hard disk LEDs are blinking from time to time, but the keyboard is probably not responding. An external USB keyboard doesn't work, although the USB port is giving power.

I know it's a hopeless situation, but maybe there is a chance to save data from swap and RAM if it is still there. I'm thinking about hibernation or getting RAM contents to an external hard disk in some way before I reboot (if it's possible). I'm really desperate, so I would do almost anything. What would help? I would appreciate any kind of help.

  • 1
    What app were you working in? Do you have another machine you can ssh from? – Paul Nov 26 '13 at 22:54
  • Well, on an old UNIX box you'd just reboot and the system would recover from the data in core. Ah, those were the good old days! – Daniel R Hicks Nov 26 '13 at 22:57
  • @Paul Just web browser and document editor. SSH? Please tell me something more about it. – user277216 Nov 26 '13 at 23:11
  • I would comment but it became too long, I will make it into an answer. – NothingsImpossible Nov 26 '13 at 23:19

The good news is that this is very likely not a serious problem. If you have simply run out of memory, the system will grind to a halt and eventually the OOM killer will step in and start killing processes and you should get your system back.

So, at least for now, the best thing to do is to simply wait and see if your system comes back to you.

If you were working on a text editor, you either have one (most really) that takes regular automatic backups so you should be fine or, almost certainly, one that also creates automatic tilde backups. Whenever you save a new version of a text file, most *nix editors will make a backup of the original with a tilde added to its name. So, foo.txt becomes foo.txt~, it is quite likely that not all your work has been lost.

While it may theoretically be possible to somehow extract the data that is stored in your RAM, it will almost certainly take you more time and effort than repeating whatever work it is you have lost.

  • It's frozen for about two hours and the disk is not hard working - just one blink from time to time so I guess the hardware is alive but there is no sense to wait longer. Maybe it is something with graphic card. – user277216 Nov 26 '13 at 23:05
  • @user277216 ah, no then, that's a different issue and unlikely to have been cause by swap or memory usage. Can you ssh from another machine? What program were you working in when this happened? – terdon Nov 26 '13 at 23:19

Maybe only your video output died somehow. Can you get a ping answer? If yes, you could log in remotely an try to save what you can.


Have you tried Ctrl-Alt-F1?

It swaps to a terminal. There you could kill an offending process or dump the document editor's memory - your document may be there, somewhere. To go back to the screen use Ctrl-Alt-F7.

Also, if entirely hopeless: One time I heard of some kind of forensics tool that you reboot your computer, it boots from USB or CD-drive and it dumps the entire RAM to disk, using little memory as possible to not overwrite existing contents. I can't recall the name though, if you search you may find it.


You might (but probably won't) get lucj by using Magic SysRQ Key - see http://en.wikipedia.org/wiki/Magic_SysRq_key - Maybe [alt][fn][sysrq]

Maybe someone else can provide you with a name of software to do it (I can't find it thus far, but this software definately exists), but you might be able to make the memory really, really cold, and then reboot the system and boot from a USB key to dump [some of] the memory to disk. (Possibly what @NothingImpossible was talking about). The software does a "cold boot attack". I did come across this software, but I suspect there are better solutions as this looks pretty difficult as its experimental from 2008. This and then this look like they might be a first step as well [ I've never done a cold boot attack, so I'm only guessing]. Its very much a last-ditch effort and unlikely to be worthwhile.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.