Can volatile RAM still contain evidence?

Do you have a question? Post it now! No Registration Necessary.  Now with pictures!

Threaded View

Can informating stored in volatile RAM still be recovered after the
computer is turned off? I remember reading something on a forensics
website that the evidence is not only on the platters of the HDD but
also on the disk cache chips and the volatile RAM chips in the PC.

Even if the PC is turned-off, the chips still contain sufficient
amount of info that can be recoverd by top-secret devils of the NSA
and Central Security Service. Apparenty they have some devices that
can read EXTREMELY-WEAK electric signals from volatile RAM chips and
recover what was lost then the power was turned-off. Is this true? If
so, how to prevent this while still expressing my socially-
unacceptable opinions on the internet?

Are there any RAM chips that are PURELY-VOLATILE and that will lose
all info when power is lost? If so, I'm thinking of buying a PC which
uses these chips. As soon as I turn off the comp, no info remains at

This is another reason I was discussing about RAM chips in another
thread a few of minutes ago.

Please note that I do not plan to write anything illegal on the net --
no threats, no confessions, etc. However, I would like to express my
opinions in chat rooms w/out facing negative consequences.

My opinions differ from that of the general public and I want to
forcefully-express my vulgar, obscene, and socially-unacceptable
opinions in chat rooms [such as Yahoo-chat, ICQ, IRC, chat-zone, and
spin-chat] without being falsely-accused of crime.

While what I would like to write in chat-rooms is not illegal, public
pressure would force authorities to do something. Public pressure
might also force the enactment of new unjust laws possibly rendering
my speeches illegal in the future.

Sometimes authorities are forced to arrest and imprison innocent law-
abiding citizens because of public outrage. At heart, the authorites
don't want to jail innocent people but they have no choice. Society,
being the evil scum it is, will overpower the police and force them to
illegaly imprison me. Crowds of sadistic human beings will overturn
police cars and start harming the police, if the police don't
arrest me. Sort of like a lynch-mob mentality against the police and

I need protection from this unlawful, public-forced treatment.

Sometimes society and the law are on opposite ends. This is one of

That is why I would like to get a PC that doesn't have any RAM that is
"purely-volatile" by my above definition.

Because I am a complete law-abiding citizen, I have nothing to hide
from the police. However, I have everything to hide from the public
and society.

In lynch-mob situations, police are powerless to do what they know is
right. The cops are helpless must be a slave to the evil society.

I respect the law, but I hate society.

For the HDD platters, even after you thoroughly delete, overwrite and
format a gazillion times, you're still on thin ice. The NSA and
Central Security Service have equipment they can use to recover data
from the magnetic platters on the HDD. The equipment they use is
*extremely* sensitive to *extremely* weak magnetic signals on the
magnetic platters. The only way to truly get rid off the data is to
heat the platters beyond Curie point. The cache chips in the HD might
also need to be burnt.

I am worried similar sensitive devices could be used to read the
extremely-weak electric signals present in the volatile RAM chips and
disc cache chips.

Due to the laws of physics, I suspect that the volatile RAM info might
-- to some extent -- exist even after the system is turned off. Sure
the wattage of those electric signals maybe *extremely*-low after shut
down, but that does not mean the signals are not there anymore -- they
are just way too weak to be detected and analyzed by ordinary means.
At the quantum level, the differences in wattage levels which
constitute what was the original volatile RAM info will continue to be
there in the chip.

I'm hoping this is just my paranoia and not true.

Also, the disc cache chips are another grave concern to me, they also
store RAM -- just not nearly as much as the platters of the HDD.

I wonder if there are any PCs for sale anywhere that are free of any
NVRAM devices and still work. The disdvantage of this is that nothing
can be saved. The advantage is, malware can't be planted in it. Such a
PC could connect to the internet and store text on websites -- for
example, I could 'save' something by emailing it to myself and then
accessing it later.



Re: Can volatile RAM still contain evidence?

Quoted text here. Click to load it

You are presumably reacting 10 months late to the paper:

Lest We Remember: Cold Boot Attacks on Encryption Keys

I and many others consider this paper to be sensationalist and even
somewhat dishonest, and are especially dismayed that it was thrust out in
a shameless self-promoting way without peer review.  The kindest thing
that can be said for it is that, while it introduced nothing new, it
reminded people of a long-known effect, RAM remanence.

It has been known at least snce the 1970s that RAM preserves state for
some time after removal of power (RAM is, after all, essentially just
capacitors) and the the length of time before full discharge is extended
by cooling.

With that out of the way, it can be said that, for most modern RAM
memory, waiting about a minute after power off is more than sufficient to
ensure that RAM is not recoverable. (If you think you may be subject to a
no-knock raid, harden your machine with automatic shutoff and obstacles
to memory access that will take at least a minute.)

For extreme paranoids the following "double shutdown" drill removes all
doubt:  Shut off the computer normally, reboot it from a CD and run a
memory zeroisation program, and then shut down for the second final time.  
(If your BIOS supports a "long memory check on POST" option, then the
shutdown-reboot-shutdown-again drill does not require a CD, zeroisation
software, etc. Just shutdown-reboot with long memory test-shutdown).

For learning about additional subtleties, google is your friend.


Re: Can volatile RAM still contain evidence?

GreenXenon wrote:
Quoted text here. Click to load it

Probably not, but I won't say never.  About 1975 or so I remember
buying some of the first 16k RAM chips, I believe from Electronic
Associates.  They worked, were reasonably priced, but used 24 pin
DIP sockets as I remember.  I found, by accident, that they would
retain their contents for something like 24 hours with all power
removed (to ensure that I removed the card from the system).  

I even advised EA of this, but they just disappeared.  At the time
development of an electrically rewriteable ROM would have been
valuable - the only thing available was UV erasable EPROMS.   I
never took advantage of their characteristic, as I had no idea how
reliable it was, and my end use was medical instrumentation.

 [mail]: Chuck F (cbfalconer at maineline dot net)
 [page]: <
            Try the download section.

Re: Can volatile RAM still contain evidence?

Quoted text here. Click to load it

Those would be static RAM chips.  The data bits were stored in
flip-flops, which means two MOS transistors per bit.  Each bit
retained its state until changed, or power was removed. As you
found out, the MOS transistors could retain their charges for
a time after power was removed.  Static RAM was expensive,
but very fast and required minimal support cicuitry.  I still have
a bunch of TI TMS4044 18 pin 4k static RAM chips.

Then along came dynamic RAM that required only one transistor
per bit, but required constant refreshing, as the data bits were
stored on tiny capacitors that would lose their charges in a fraction
of a microsecond. Dynamic RAM was a lot less expensive, and
able to be packed into large capacity, dense arrays. Now we have
densities of 2 gigabits per chip.

Re: Can volatile RAM still contain evidence?

Ian D wrote:
Quoted text here. Click to load it
Point of order your honour.

It was about 50 milliseconds actually, in early desktop computer designs
( cf Apple][ ) they were refreshed by the frame scan of memory-mapped
video without any additional circuitry.

Tim Jackson

Re: Can volatile RAM still contain evidence?

Ian D wrote:
Quoted text here. Click to load it

They definitely were static.  However, 24 hours seemed excessive.
I tested them for complete memory over the period.

 [mail]: Chuck F (cbfalconer at maineline dot net)
 [page]: <
            Try the download section.

Re: Can volatile RAM still contain evidence?

Somewhere on teh intarwebs "GreenXenon" typed:
Quoted text here. Click to load it

Surely then the logical thing to do is isolate yourself, become a hermit,
rather than antagonise?

Unless some of that hate expresses as self-hate as, obviously, if you're
partiicipating in 'society' via chat then you're part of the thing you
profess to hate.

Re: Can volatile RAM still contain evidence?

Quoted text here. Click to load it

  <Snip the rest of the paranoia.>

Quoted text here. Click to load it

    "Radium"  is a famous "gift" from GoogleGroups.  That
they still let him have access to a computer must be a reward
of some kind.  Probably for pretending to take his meds.
While it's possible this is a different "Radium", it fits his old
style.  You can expect it to get more weird as time goes by.


Re: Can volatile RAM still contain evidence?

Quoted text here. Click to load it

Sure, but if you think that hides you you are badly informed.

Quoted text here. Click to load it


Re: Can volatile RAM still contain evidence?

On Mon, 22 Dec 2008 17:17:49 -0800 (PST), GreenXenon

Quoted text here. Click to load it

Well it's beside the point now, we've located you and will
be by shortly...

Site Timeline