RAM and data recovery

Discussion in 'Computer Security' started by someone2, Jun 13, 2005.

  1. someone2

    someone2 Guest

    This question relates to the disposition of computers when upgrading or for
    resale/donation.

    If the computer was booted up the day before disposition and shut down
    normally could data be recovered the next day from the RAM.
    Same scenario, change the time period to one week?

    3rd scenario, bootable desktop. AC is disconnected and the mainboard battery
    is removed - what could be recovered from the RAM the next day?

    btw I am not a student completing research, I am interested in the topic re
    recycling of used computers.
    If any of the group could provide information on textbooks or white papers
    covering this topic it would be greatly appreciated.

    Naturally I googled this topic before posting to the group.
     
    someone2, Jun 13, 2005
    #1
    1. Advertising

  2. someone2

    Chris Salter Guest

    someone2 wrote:

    > This question relates to the disposition of computers when upgrading or for
    > resale/donation.
    >
    > If the computer was booted up the day before disposition and shut down
    > normally could data be recovered the next day from the RAM.
    > Same scenario, change the time period to one week?
    >
    > 3rd scenario, bootable desktop. AC is disconnected and the mainboard battery
    > is removed - what could be recovered from the RAM the next day?
    >
    > btw I am not a student completing research, I am interested in the topic re
    > recycling of used computers.
    > If any of the group could provide information on textbooks or white papers
    > covering this topic it would be greatly appreciated.
    >
    > Naturally I googled this topic before posting to the group.


    No, no & no. Google, how ram works.

    --
    Chris Salter
     
    Chris Salter, Jun 13, 2005
    #2
    1. Advertising

  3. On Mon, 13 Jun 2005 12:14:01 -0400, "someone2"
    <> wrote:

    >This question relates to the disposition of computers when upgrading or for
    >resale/donation.
    >
    >If the computer was booted up the day before disposition and shut down
    >normally could data be recovered the next day from the RAM.
    >Same scenario, change the time period to one week?
    >
    >3rd scenario, bootable desktop. AC is disconnected and the mainboard battery
    >is removed - what could be recovered from the RAM the next day?
    >
    >btw I am not a student completing research, I am interested in the topic re
    >recycling of used computers.
    >If any of the group could provide information on textbooks or white papers
    >covering this topic it would be greatly appreciated.
    >
    >Naturally I googled this topic before posting to the group.
    >
    >

    Surely all data is lost from ram once the power is cut?
    Assuming it isn't, I'd think you'd have to have some pretty smart
    tools to recover what might left lurking there...and would anyone be
    that interested?

    The biggest risk by far is the hard drive - but there are plenty of
    tools available for securely wiping the drive beyond the capabilities
    of all but the most advanced recovery techniques....and if you feel
    you're likely to come under such scrutiny then your best bet would be
    to remove the drive and keep it/destroy it.

    Regards,



    --
    Stephen Howard - Woodwind repairs & period restorations
    www.shwoodwind.co.uk
    Emails to: showard{whoisat}shwoodwind{dot}co{dot}uk
     
    Stephen Howard, Jun 13, 2005
    #3
  4. someone2

    someone2 Guest

    "Chris Salter" <> wrote in message
    news:...
    > someone2 wrote:
    >
    >> This question relates to the disposition of computers when upgrading or
    >> for resale/donation.
    >>
    >> If the computer was booted up the day before disposition and shut down
    >> normally could data be recovered the next day from the RAM.
    >> Same scenario, change the time period to one week?
    >>
    >> 3rd scenario, bootable desktop. AC is disconnected and the mainboard
    >> battery is removed - what could be recovered from the RAM the next day?
    >>
    >> btw I am not a student completing research, I am interested in the topic
    >> re recycling of used computers.
    >> If any of the group could provide information on textbooks or white
    >> papers covering this topic it would be greatly appreciated.
    >>
    >> Naturally I googled this topic before posting to the group.

    >
    > No, no & no. Google, how ram works.
    >
    > --
    > Chris Salter


    Excellent suggestion, I should have thought of the "how stuff works"
    website.
    I should have also checked the sites of the major players in the RAM market.

    I would still appreciate any hardcopy books I could reference (a newspaper
    article this weekend printed a number of common misconceptions re data
    recovery)

    I can see the next input - I'll search the topic at Amazon and at least one
    University library!
     
    someone2, Jun 13, 2005
    #4
  5. someone2

    someone2 Guest

    "Stephen Howard" <> wrote in message
    news:...
    > On Mon, 13 Jun 2005 12:14:01 -0400, "someone2"
    > <> wrote:
    >
    >>This question relates to the disposition of computers when upgrading or
    >>for
    >>resale/donation.
    >>
    >>If the computer was booted up the day before disposition and shut down
    >>normally could data be recovered the next day from the RAM.
    >>Same scenario, change the time period to one week?
    >>
    >>3rd scenario, bootable desktop. AC is disconnected and the mainboard
    >>battery
    >>is removed - what could be recovered from the RAM the next day?
    >>
    >>btw I am not a student completing research, I am interested in the topic
    >>re
    >>recycling of used computers.
    >>If any of the group could provide information on textbooks or white papers
    >>covering this topic it would be greatly appreciated.
    >>
    >>Naturally I googled this topic before posting to the group.
    >>
    >>

    > Surely all data is lost from ram once the power is cut?
    > Assuming it isn't, I'd think you'd have to have some pretty smart
    > tools to recover what might left lurking there...and would anyone be
    > that interested?
    >
    > The biggest risk by far is the hard drive - but there are plenty of
    > tools available for securely wiping the drive beyond the capabilities
    > of all but the most advanced recovery techniques....and if you feel
    > you're likely to come under such scrutiny then your best bet would be
    > to remove the drive and keep it/destroy it.
    >
    > Regards,
    >
    >
    >
    > --
    > Stephen Howard - Woodwind repairs & period restorations
    > www.shwoodwind.co.uk
    > Emails to: showard{whoisat}shwoodwind{dot}co{dot}uk


    Great response.
    The published article in question is "Shreds of safety" published by the
    "Cox news service" - they publish across the east coast of the US. I am not
    sure if you would find an online copy -I have a hard copy on my desk.

    In summary of the article basically they are indicating the only way to
    ensure safety of data is via physical destruction of the mainboard and hard
    drive.

    Meanwhile there are many individuals and groups who could use the same
    computers once they were sanitized and recycled.

    My intention is to write a press release for public knowledge re the facts
    of data recovery.

    ie. One claim in the article by the owner of the shredding company re hdd
    and data recovery

    "If you're just overlaying data on top of data, a good hacker who has no
    time limits can certainly figure out ways to unlayer the data"

    I guess he's recovered data after only a 3 times over write of a hdd, let
    alone a DoD wipe?
     
    someone2, Jun 13, 2005
    #5
  6. someone2

    nemo_outis Guest

    "someone2" <> wrote in
    news:dhire.32692$iU.350@lakeread05:

    > This question relates to the disposition of computers when upgrading
    > or for resale/donation.
    >
    > If the computer was booted up the day before disposition and shut down
    > normally could data be recovered the next day from the RAM.
    > Same scenario, change the time period to one week?
    >
    > 3rd scenario, bootable desktop. AC is disconnected and the mainboard
    > battery is removed - what could be recovered from the RAM the next
    > day?
    >
    > btw I am not a student completing research, I am interested in the
    > topic re recycling of used computers.
    > If any of the group could provide information on textbooks or white
    > papers covering this topic it would be greatly appreciated.
    >
    > Naturally I googled this topic before posting to the group.



    Unless you fear recovery attempts by well-equipped labs run by TLAs,
    you're safe. While the contents of RAM do tend tend to become "etched"
    if the same area contains the same data for long periods (e.g., a
    password that is always loaded early, is never moved or swapped out of
    ram, and remains there all day, every day) the main ways of permanently
    snapshoting ram include strong ionizing radiation or subjection to very
    cold temperatures while it still contains data or very shortly after it
    is powered off.

    The buzzwords to look up on Google are "ram" and "remanence." You will
    find many hits (even by Peter Guttman); I'll post one url (Peter's) to
    get you started:

    http://www.cypherpunks.to/~peter/usenix01.pdf

    Regards,
     
    nemo_outis, Jun 13, 2005
    #6
  7. someone2

    Martin Guest

    someone2 wrote:
    > This question relates to the disposition of computers when upgrading or for
    > resale/donation.
    >
    > If the computer was booted up the day before disposition and shut down
    > normally could data be recovered the next day from the RAM.
    > Same scenario, change the time period to one week?


    I vaguely remembered something about this from a few years ago.

    Googling on "quantum data recovery DRAM" I found a paper by Gutmann,
    http://wipe.sourceforge.net/secure_del.html
     
    Martin, Jun 13, 2005
    #7
  8. someone2

    someone2 Guest

    "Martin" <> wrote in message
    news:42adcd6a$0$22591$...
    > someone2 wrote:
    >> This question relates to the disposition of computers when upgrading or
    >> for resale/donation.
    >>
    >> If the computer was booted up the day before disposition and shut down
    >> normally could data be recovered the next day from the RAM.
    >> Same scenario, change the time period to one week?

    >
    > I vaguely remembered something about this from a few years ago.
    >
    > Googling on "quantum data recovery DRAM" I found a paper by Gutmann,
    > http://wipe.sourceforge.net/secure_del.html


    Thank you for the references to Gutmann.
    I have a link on my web site to an article he created re data recovery from
    hard disk drive platters.
     
    someone2, Jun 13, 2005
    #8
  9. someone2

    nemo_outis Guest

    "someone2" <> wrote in
    news:dhire.32692$iU.350@lakeread05:

    > This question relates to the disposition of computers when upgrading
    > or for resale/donation.
    >
    > If the computer was booted up the day before disposition and shut down
    > normally could data be recovered the next day from the RAM.
    > Same scenario, change the time period to one week?
    >
    > 3rd scenario, bootable desktop. AC is disconnected and the mainboard
    > battery is removed - what could be recovered from the RAM the next
    > day?
    >
    > btw I am not a student completing research, I am interested in the
    > topic re recycling of used computers.
    > If any of the group could provide information on textbooks or white
    > papers covering this topic it would be greatly appreciated.
    >
    > Naturally I googled this topic before posting to the group.
    >


    Unless you fear recovery attempts by well-equipped labs run by TLAs,
    you're safe. While the contents of RAM do tend tend to become "etched"
    if the same area contains the same data for long periods (e.g., a
    password that is always loaded early, is never moved or swapped out of
    ram, and remains there all day, every day) the main ways of permanently
    snapshoting ram include strong ionizing radiation or subjection to very
    cold temperatures while it still contains data or very shortly after it
    is powered off.

    The buzzwords to look up on Google are "ram" and "remanence." You will
    find many hits (even by Peter Guttman); I'll post one url (Peter's) to
    get you started:

    http://www.cypherpunks.to/~peter/usenix01.pdf

    Regards,
     
    nemo_outis, Jun 13, 2005
    #9
  10. someone2

    nemo_outis Guest

    "someone2" <> wrote in
    news:dhire.32692$iU.350@lakeread05:

    > This question relates to the disposition of computers when upgrading
    > or for resale/donation.
    >
    > If the computer was booted up the day before disposition and shut down
    > normally could data be recovered the next day from the RAM.
    > Same scenario, change the time period to one week?
    >
    > 3rd scenario, bootable desktop. AC is disconnected and the mainboard
    > battery is removed - what could be recovered from the RAM the next
    > day?
    >
    > btw I am not a student completing research, I am interested in the
    > topic re recycling of used computers.
    > If any of the group could provide information on textbooks or white
    > papers covering this topic it would be greatly appreciated.
    >
    > Naturally I googled this topic before posting to the group.
    >

    Unless you fear recovery attempts by well-equipped labs run by TLAs,
    you're safe. While the contents of RAM do tend tend to become "etched"
    if the same area contains the same data for long periods (e.g., a
    password that is always loaded early, is never moved or swapped out of
    ram, and remains there all day, every day) the main ways of permanently
    snapshoting ram include strong ionizing radiation or subjection to very
    cold temperatures while it still contains data or very shortly after it
    is powered off.

    The buzzwords to look up on Google are "ram" and "remanence." You will
    find many hits (even by Peter Guttman); I'll post one url (Peter's) to
    get you started:

    http://www.cypherpunks.to/~peter/usenix01.pdf

    Regards,
     
    nemo_outis, Jun 13, 2005
    #10
  11. someone2

    nemo_outis Guest

    "nemo_outis" <> wrote in news:Xns96748640B83F9abcxyzcom@
    127.0.0.1:



    Sorry about the repeated posts; in a moment of monumental stupidity I had
    accidentally killfiled myself and wasn't seeing my own posts!

    I'll just nip off and beat myself about the head and shoulders.

    Regards,
     
    nemo_outis, Jun 13, 2005
    #11
  12. someone2

    Martin Guest

    nemo_outis wrote:
    > "nemo_outis" <> wrote in news:Xns96748640B83F9abcxyzcom@
    > 127.0.0.1:
    >
    >
    >
    > Sorry about the repeated posts; in a moment of monumental stupidity I had
    > accidentally killfiled myself and wasn't seeing my own posts!


    rofl! best chuckle I've had in ages that one
     
    Martin, Jun 13, 2005
    #12
  13. nemo_outis <> wrote:
    > "nemo_outis" <> wrote in news:Xns96748640B83F9abcxyzcom@
    > 127.0.0.1:


    > Sorry about the repeated posts; in a moment of monumental stupidity I had
    > accidentally killfiled myself and wasn't seeing my own posts!
    >
    > I'll just nip off and beat myself about the head and shoulders.


    Hey, there's no need to be *that* negative about your posts! ;-)

    Joachim
     
    Joachim Schipper, Jul 5, 2005
    #13
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Author Tarun Tyagi
    Replies:
    0
    Views:
    771
    Author Tarun Tyagi
    Dec 29, 2004
  2. Jacques Clouseau

    suggestions re: data recovery services for Peachtree data?

    Jacques Clouseau, Aug 2, 2004, in forum: Computer Support
    Replies:
    4
    Views:
    2,633
    GuruofData
    Apr 9, 2008
  3. Digital Image Recovery
    Replies:
    1
    Views:
    1,331
  4. Author Tarun Tyagi
    Replies:
    1
    Views:
    5,787
    salvationxue
    Apr 3, 2009
  5. Digital Image Recovery

    Digital Image Recovery and Memory Stick Recovery; Recovery of Lost Photos

    Digital Image Recovery, Sep 10, 2004, in forum: Digital Photography
    Replies:
    0
    Views:
    1,181
    Digital Image Recovery
    Sep 10, 2004
Loading...

Share This Page