In case you have not already come across this recently, the BBC have an article on the fact that information stored in your computer’s RAM is not lost the moment you turn your PC off. Given that some passwords, and even contents of some documents that are otherwise encrypted (on the hard drive) are stored in RAM, this has security implications for many companies, and even some private individuals. Check out the link for more details, but basically a team has created some software that can be used whilst booting from a CD or thumbdrive, which can automatically search for, then extract, passwords and other sensitive information.
I did notice one error in the piece though – “… or while it is in sleeping or hibernation mode,” said Professor Felten. In these modes the laptop is not running, but information is still stored in RAM to allow it to “wake up” quickly.” Now unless I’ve misunderstood hibernation mode entirely, you will not find information permanently stored there. For me at least, the whole point of hibernation is that you can completely remove the power source for your PC, and still have it wake up very quickly when you do turn it on once more. If the information was actually left in RAM, then your PC would boot up correctly after you had removed and then later reattached the power lead. Anyway, still an interesting read IMO.
Apr 25 2008
April 28th, 2008 2:18 am
If they (malicious persons) cut the power (i.e., remove the battery) — will they be able to restore the information contained in memory? I don’t understand this.
On the other hand, what’s the problem with taking the hiberfile.sys and analyzing what’s in memory (provided the laptop was in hybernation state)?
I must have missed something in this life.