RAM and data recovery

This question relates to the disposition of computers when upgrading or for
resale/donation.

If the computer was booted up the day before disposition and shut down
normally could data be recovered the next day from the RAM.
Same scenario, change the time period to one week?

3rd scenario, bootable desktop. AC is disconnected and the mainboard battery
is removed - what could be recovered from the RAM the next day?

btw I am not a student completing research, I am interested in the topic re
recycling of used computers.
If any of the group could provide information on textbooks or white papers
covering this topic it would be greatly appreciated.

Naturally I googled this topic before posting to the group.

someone2

someone2 wrote:

> This question relates to the disposition of computers when upgrading or for
> resale/donation.
>
> If the computer was booted up the day before disposition and shut down
> normally could data be recovered the next day from the RAM.
> Same scenario, change the time period to one week?
>
> 3rd scenario, bootable desktop. AC is disconnected and the mainboard battery
> is removed - what could be recovered from the RAM the next day?
>
> btw I am not a student completing research, I am interested in the topic re
> recycling of used computers.
> If any of the group could provide information on textbooks or white papers
> covering this topic it would be greatly appreciated.
>
> Naturally I googled this topic before posting to the group.

No, no & no. Google, how ram works.

--
Chris Salter

Chris Salter

On Mon, 13 Jun 2005 12:14:01 -0400, "someone2"
<> wrote:

>This question relates to the disposition of computers when upgrading or for
>resale/donation.
>
>If the computer was booted up the day before disposition and shut down
>normally could data be recovered the next day from the RAM.
>Same scenario, change the time period to one week?
>
>3rd scenario, bootable desktop. AC is disconnected and the mainboard battery
>is removed - what could be recovered from the RAM the next day?
>
>btw I am not a student completing research, I am interested in the topic re
>recycling of used computers.
>If any of the group could provide information on textbooks or white papers
>covering this topic it would be greatly appreciated.
>
>Naturally I googled this topic before posting to the group.
>
>
Surely all data is lost from ram once the power is cut?
Assuming it isn't, I'd think you'd have to have some pretty smart
tools to recover what might left lurking there...and would anyone be
that interested?

The biggest risk by far is the hard drive - but there are plenty of
tools available for securely wiping the drive beyond the capabilities
of all but the most advanced recovery techniques....and if you feel
you're likely to come under such scrutiny then your best bet would be
to remove the drive and keep it/destroy it.

Regards,



--
Stephen Howard - Woodwind repairs & period restorations
www.shwoodwind.co.uk
Emails to: showard{whoisat}shwoodwind{dot}co{dot}uk

Stephen Howard

"Chris Salter" <> wrote in message
news:...
> someone2 wrote:
>
>> This question relates to the disposition of computers when upgrading or
>> for resale/donation.
>>
>> If the computer was booted up the day before disposition and shut down
>> normally could data be recovered the next day from the RAM.
>> Same scenario, change the time period to one week?
>>
>> 3rd scenario, bootable desktop. AC is disconnected and the mainboard
>> battery is removed - what could be recovered from the RAM the next day?
>>
>> btw I am not a student completing research, I am interested in the topic
>> re recycling of used computers.
>> If any of the group could provide information on textbooks or white
>> papers covering this topic it would be greatly appreciated.
>>
>> Naturally I googled this topic before posting to the group.
>
> No, no & no. Google, how ram works.
>
> --
> Chris Salter

Excellent suggestion, I should have thought of the "how stuff works"
website.
I should have also checked the sites of the major players in the RAM market.

I would still appreciate any hardcopy books I could reference (a newspaper
article this weekend printed a number of common misconceptions re data
recovery)

I can see the next input - I'll search the topic at Amazon and at least one
University library!

someone2

"Stephen Howard" <> wrote in message
news:...
> On Mon, 13 Jun 2005 12:14:01 -0400, "someone2"
> <> wrote:
>
>>This question relates to the disposition of computers when upgrading or
>>for
>>resale/donation.
>>
>>If the computer was booted up the day before disposition and shut down
>>normally could data be recovered the next day from the RAM.
>>Same scenario, change the time period to one week?
>>
>>3rd scenario, bootable desktop. AC is disconnected and the mainboard
>>battery
>>is removed - what could be recovered from the RAM the next day?
>>
>>btw I am not a student completing research, I am interested in the topic
>>re
>>recycling of used computers.
>>If any of the group could provide information on textbooks or white papers
>>covering this topic it would be greatly appreciated.
>>
>>Naturally I googled this topic before posting to the group.
>>
>>
> Surely all data is lost from ram once the power is cut?
> Assuming it isn't, I'd think you'd have to have some pretty smart
> tools to recover what might left lurking there...and would anyone be
> that interested?
>
> The biggest risk by far is the hard drive - but there are plenty of
> tools available for securely wiping the drive beyond the capabilities
> of all but the most advanced recovery techniques....and if you feel
> you're likely to come under such scrutiny then your best bet would be
> to remove the drive and keep it/destroy it.
>
> Regards,
>
>
>
> --
> Stephen Howard - Woodwind repairs & period restorations
> www.shwoodwind.co.uk
> Emails to: showard{whoisat}shwoodwind{dot}co{dot}uk

Great response.
The published article in question is "Shreds of safety" published by the
"Cox news service" - they publish across the east coast of the US. I am not
sure if you would find an online copy -I have a hard copy on my desk.

In summary of the article basically they are indicating the only way to
ensure safety of data is via physical destruction of the mainboard and hard
drive.

Meanwhile there are many individuals and groups who could use the same
computers once they were sanitized and recycled.

My intention is to write a press release for public knowledge re the facts
of data recovery.

ie. One claim in the article by the owner of the shredding company re hdd
and data recovery

"If you're just overlaying data on top of data, a good hacker who has no
time limits can certainly figure out ways to unlayer the data"

I guess he's recovered data after only a 3 times over write of a hdd, let
alone a DoD wipe?

someone2

"someone2" <> wrote in
news:dhire.32692$iU.350@lakeread05:

> This question relates to the disposition of computers when upgrading
> or for resale/donation.
>
> If the computer was booted up the day before disposition and shut down
> normally could data be recovered the next day from the RAM.
> Same scenario, change the time period to one week?
>
> 3rd scenario, bootable desktop. AC is disconnected and the mainboard
> battery is removed - what could be recovered from the RAM the next
> day?
>
> btw I am not a student completing research, I am interested in the
> topic re recycling of used computers.
> If any of the group could provide information on textbooks or white
> papers covering this topic it would be greatly appreciated.
>
> Naturally I googled this topic before posting to the group.


Unless you fear recovery attempts by well-equipped labs run by TLAs,
you're safe. While the contents of RAM do tend tend to become "etched"
if the same area contains the same data for long periods (e.g., a
password that is always loaded early, is never moved or swapped out of
ram, and remains there all day, every day) the main ways of permanently
snapshoting ram include strong ionizing radiation or subjection to very
cold temperatures while it still contains data or very shortly after it
is powered off.

The buzzwords to look up on Google are "ram" and "remanence." You will
find many hits (even by Peter Guttman); I'll post one url (Peter's) to
get you started:

http://www.cypherpunks.to/~peter/usenix01.pdf

Regards,

nemo_outis

someone2 wrote:
> This question relates to the disposition of computers when upgrading or for
> resale/donation.
>
> If the computer was booted up the day before disposition and shut down
> normally could data be recovered the next day from the RAM.
> Same scenario, change the time period to one week?

I vaguely remembered something about this from a few years ago.

Googling on "quantum data recovery DRAM" I found a paper by Gutmann,
http://wipe.sourceforge.net/secure_del.html

Martin

"Martin" <> wrote in message
news:42adcd6a$0$22591$...
> someone2 wrote:
>> This question relates to the disposition of computers when upgrading or
>> for resale/donation.
>>
>> If the computer was booted up the day before disposition and shut down
>> normally could data be recovered the next day from the RAM.
>> Same scenario, change the time period to one week?
>
> I vaguely remembered something about this from a few years ago.
>
> Googling on "quantum data recovery DRAM" I found a paper by Gutmann,
> http://wipe.sourceforge.net/secure_del.html

Thank you for the references to Gutmann.
I have a link on my web site to an article he created re data recovery from
hard disk drive platters.

someone2

"someone2" <> wrote in
news:dhire.32692$iU.350@lakeread05:

> This question relates to the disposition of computers when upgrading
> or for resale/donation.
>
> If the computer was booted up the day before disposition and shut down
> normally could data be recovered the next day from the RAM.
> Same scenario, change the time period to one week?
>
> 3rd scenario, bootable desktop. AC is disconnected and the mainboard
> battery is removed - what could be recovered from the RAM the next
> day?
>
> btw I am not a student completing research, I am interested in the
> topic re recycling of used computers.
> If any of the group could provide information on textbooks or white
> papers covering this topic it would be greatly appreciated.
>
> Naturally I googled this topic before posting to the group.
>

Unless you fear recovery attempts by well-equipped labs run by TLAs,
you're safe. While the contents of RAM do tend tend to become "etched"
if the same area contains the same data for long periods (e.g., a
password that is always loaded early, is never moved or swapped out of
ram, and remains there all day, every day) the main ways of permanently
snapshoting ram include strong ionizing radiation or subjection to very
cold temperatures while it still contains data or very shortly after it
is powered off.

The buzzwords to look up on Google are "ram" and "remanence." You will
find many hits (even by Peter Guttman); I'll post one url (Peter's) to
get you started:

http://www.cypherpunks.to/~peter/usenix01.pdf

Regards,

nemo_outis

"someone2" <> wrote in
news:dhire.32692$iU.350@lakeread05:

> This question relates to the disposition of computers when upgrading
> or for resale/donation.
>
> If the computer was booted up the day before disposition and shut down
> normally could data be recovered the next day from the RAM.
> Same scenario, change the time period to one week?
>
> 3rd scenario, bootable desktop. AC is disconnected and the mainboard
> battery is removed - what could be recovered from the RAM the next
> day?
>
> btw I am not a student completing research, I am interested in the
> topic re recycling of used computers.
> If any of the group could provide information on textbooks or white
> papers covering this topic it would be greatly appreciated.
>
> Naturally I googled this topic before posting to the group.
>
Unless you fear recovery attempts by well-equipped labs run by TLAs,
you're safe. While the contents of RAM do tend tend to become "etched"
if the same area contains the same data for long periods (e.g., a
password that is always loaded early, is never moved or swapped out of
ram, and remains there all day, every day) the main ways of permanently
snapshoting ram include strong ionizing radiation or subjection to very
cold temperatures while it still contains data or very shortly after it
is powered off.

The buzzwords to look up on Google are "ram" and "remanence." You will
find many hits (even by Peter Guttman); I'll post one url (Peter's) to
get you started:

http://www.cypherpunks.to/~peter/usenix01.pdf

Regards,

nemo_outis