Initial Question: How to extract computer memory data when computers are frozen. I removed my question from that topic to post here per request.

This article is a how-to tutorial on using a "coldboot" attack to recover encryption keys. It is based on several references linked in that article. One is from Princeton University, the other the Hak5 site. They are all based on a finding at Princeton that the the contents of RAM do not immediately disappear. They can persist for seconds to minutes at room temperature, or longer with freezing, after the power is removed, even removing the RAM modules from the motherboard. The Princeton paper mentions the potential to acquire usable full-system memory images by this method. The first link refers to recovering 8 to 16GB of data from a preceding boot, which could be any data on the 'frozen', or as referred to in the previous question, 'deadlocked', PC.

It appears that it is at least theoretically possible to recover RAM contents from a frozen system with this approach, either by transplanting the RAM to another computer or using a USB tool like described in the first link, and obviously results would vary. But would this be a "go-to" (preferred) method to use at home? Would this be more practical or less practical that other methods like DMA? Would it be expected to have a higher or lower chance of success? Would it be something to try first or only as a last resort, or would that depend on the availability of equipment and software required for a DMA approach? This question is from the perspective of someone who is not intimately familiar with either method.

  • David - I proposed some edits to the question. See what you think. Feel free to accept or reject. – fixer1234 Nov 11 '14 at 22:28
  • I suggested making this a separate question because it was originally written in the form of a question and you weren't clear whether it would work. The whole topic of using the Princeton approach deserves its own attention. However, there is no reason why the information can't also be used in an answer to the previous question. State the information as an answer with appropriate caveats, like it might be something to explore if other options aren't available since it's hard to make efficacy claims. – fixer1234 Nov 11 '14 at 22:46
  • I accepted the changes. I offered this as a potential solution. Maybe something not as effective as this isn't a topic I am all too familiar. I just seen the question and remembered a few things I read in the past.In the process of answering, I also had questions. But thanks for your help on the etiquette here and the revision. – David Nov 11 '14 at 23:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.