Hello I would like to know if there any device which could preserve content of RAM once removed from a host system and this special device could be connected perhaps by way of USB to another machine for forensic analysis ? The reason for the special device is because I believe that the memory controller may have technologies which could prevent a complete memory dump via say Windows for the entire memory space. The memory address space may be altered preventing an entire or complete memory capture, dump. Some sort of device that law enforcement may use.
6
-
2\$\begingroup\$ You can cool the memory with nitrogen and put it in a board custom made to quickly dump the contents. There are papers and examples of it working online. It is one method to break encryption if you can steal the suspect computer after the pre boot encryption key has been entered... \$\endgroup\$– MadHatterCommented Jun 5, 2016 at 4:16
-
\$\begingroup\$ The show-stopper problem with your scheme is somehow getting the memory OUT of the computer and INTO whatever preserving gadget without losing the data. If you can provide some way to make contact with the 100s of pins on a DRAM stick before removing it, you can continue to provide the required power and refresh clock cycles, so you can keep the data from disappearing. \$\endgroup\$– Richard CrowleyCommented Jun 5, 2016 at 4:48
-
\$\begingroup\$ Super cooling RAM will hold the memory state for 5 to 10 minutes. \$\endgroup\$– MadHatterCommented Jun 5, 2016 at 5:38
-
\$\begingroup\$ Modern ddr3 ram can take 10+ minutes to decay but this is HIGHLY variable and random, provided you had something like a custom memory controller running on an fpga and you could swap the sticks quickly, then I think it's entirely possible for a device to exist, however, that's not to say that anything like this actually exists, but the potential is there \$\endgroup\$– SamCommented Jun 5, 2016 at 8:33
-
\$\begingroup\$ Some discussion at security.stackexchange.com/questions/99906/… \$\endgroup\$– pjc50Commented Jun 5, 2016 at 9:24
|
Show 1 more comment
1 Answer
\$\begingroup\$
\$\endgroup\$
2
Yes. Viking, for one example, has DIMMs with built-in Flash, and a super-capacitor to power the RAM/flash for long enough to copy the RAM to Flash in case of power outage.
At least at one time, there were also DIMMs with built-in battery back up, but these seem to be less popular than the RAM/Flash version, at least for the moment.
-
\$\begingroup\$ This answer appears to completely miss the requirements of the original question. Devising some solution for preserving data in RANDOM EXISTING computers for subsequent forensic analysis. There is no opportunity here to DESIGN something with special memory components. \$\endgroup\$ Commented Jun 5, 2016 at 6:24
-
3\$\begingroup\$ @Richard the question is "does ... exist", so I think this answer is totally appropriate. \$\endgroup\$ Commented Jun 5, 2016 at 8:47