AiOwares
RAM and it's degradation - Printable Version

+- AiOwares (https://www.aiowares.com)
+-- Forum: Cyber & Forensics (https://www.aiowares.com/forumdisplay.php?fid=65)
+--- Forum: Cyber Crime Investigation (https://www.aiowares.com/forumdisplay.php?fid=67)
+--- Thread: RAM and it's degradation (/showthread.php?tid=1446)

RAM and it's degradation - Bl4ckCyb3rEnigm4 - 11-27-2019

A RAM after the computer is shutted down start is degradation of what contains, but if you cryogenically freeze the RAM, you will make the degradation process slower nearly arresting it. That work because the copper that is contained inside the RAM will become less conductor if the temperature is enough low. You will what you can do knowing that here an article about a use of the RAM in the forensics field
Code:
https://www.zdnet.com/article/cryogenically-frozen-ram-bypasses-all-disk-encryption-methods/
This article is very interesting because show how disk encryption methods are unsuccessful if the forensic investigator can get the hand on the RAM before the data from the RAM are completely gone, it's a matter of time.

RE: RAM and it's degradation - sterki - 02-23-2021

so if a ram module is froze the data it contained right aftfer the shutdown is kept for more time, to be honest i thought that when shutdown the ram would be clean from what was loaded into it oO
thanks for the share @Bl4ckCyb3rEnigm4

RE: RAM and it's degradation - Oye_Vey - 03-02-2021

Seems reasonable to me.  I have workstations with will ECC RAM that will sometimes throw ECC parity errors after cold shutdowns but not warm reboots.  Apparently it's because of the difference in the residual "flea" power between the cold shutdowns and the warm reboots.

RE: RAM and it's degradation - yyjh - 04-18-2021

(03-02-2021, 02:28 PM)Oye_Vey Wrote: Seems reasonable to me.  I have workstations with will ECC RAM that will sometimes throw ECC parity errors after cold shutdowns but not warm reboots.  Apparently it's because of the difference in the residual "flea" power between the cold shutdowns and the warm reboots.

Can you please elaborate? If ECC RAM throws errors because residual data are not wiped clean at boot, what could happen to Non-ECC RAM?

RE: RAM and it's degradation - fgrethrtjhj - 05-18-2021

It's called a cold boot attack. Classic trick.

RE: RAM and it's degradation - Darthagnon - 06-09-2021

On a similar note, I remember reading an article about a proof-of-concept experiment that turned normal RAM into WiFi cards, to steal data from air-gapped systems. Found the article:
Code:
https://www.zdnet.com/article/academics-turn-ram-into-wifi-cards-to-steal-data-from-air-gapped-systems/


RE: RAM and it's degradation - Pz_Miko - 06-24-2021

But isn't Cryogenic freezing cost a lot of money? Makes sense for any high profile cases but what if they are some small-time cases?