Memory (RAM) of computers after shut down

Question

After computer shuts down, is it possible to retrieve data in RAM? I heard that police was able to do that... so I felt that was somehow weird..

Answer 1

It's not like a powerdown deliberately erases data, so it's mainly leakage currents through which a bit's value is lost over time. That can be minutes, but you can't rely on that; it may also be seconds, and depending on your data, a couple of changed bits can render all of it worthless, for instance if they're looking for encryption keys.

The police will have a hard time with it. It will have to remove the memory, because powering the PC on again will overwrite much of it, place the memory in another computer which will not do so, and do all of this as quickly as possible. I don't think they do this.

It should be noted that low temperatures will decrease leakage current from the memory cell's capacitor, so to a certain extent you can "freeze" memory.

Answer 2

As stevenvh pointed out, the data disappears mainly by current leakage. This process can be slowed down by cooling (e.g. compressed air). The main paper is called Lest We Remember: Cold Boot Attacks on Encryption Keys. Besides that specialized hardware like CaptureGUARD can be used by anyone.

Answer 3

Conceptually, an unpowered memory cell will hold its bits as an analog level of charge. If one could read out the precise level of charge on every transistor within a memory chip without powering it on, one could probably pretty well reconstruct its contents even after it had been powered down for a long time (perhaps even days).

In practice, however, there is generally no feasible way of reading the precise charge level of any transistor in a memory array (much less every transistor) without powering it on. Powering on a static memory array will instantly cause every bit to switch state to a solid "one" or a solid "zero". If the charge levels are insufficient to be detected by the circuitry within the chip, any information present in the charge levels will be lost.

Dynamic RAM is a little different. If a memory is not commanded to perform refresh cycles, merely applying power will not disrupt the charge levels of its storage cells. On the other hand, the only way a DRAM can try to read a memory cell (a small capacitor) is to connect it to a memory bus (which behaves as a much larger capacitor) which is charged to VDD/2, and observe whether that causes the bus voltage to go up or down. The memory cell will end up with a voltage essentially equal to VDD/2 after this process is performed. If one had a means of measuring the charge on a memory cell without having to connect it to something with such huge capacitance, it might be possible to ascertain the state of non-refreshed memory bits much longer. On the other hand, memory chips generally don't provide any such facility (since their goal is to be cheap).