As far as I know, there are two methods for performing cold boot attacks:
- Reboot the system into an alternate operating system or BIOS with a minimal memory footprint which automatically exports memory to persistent media.
- Physically remove the memory modules and put them on a motherboard or analyzer with RAM hotplugging enabled, and directly read memory off of them.
Both methods can optionally involve cooling the memory modules to allow the contents of memory to persist longer. However each method has its own downsides. The first method can be problematic because the system may not boot if a BIOS password is set, and POST may overwrite the memory, especially if it is ECC. The second method's downside is that physically removing memory takes more time and increases the chance that data will be lost, and that many devices may have memory soldered onto the motherboard and unmovable. Both techniques may have problems with DDR3 and DDR4 memory due to higher volatility and memory scrambling which is enabled in newer BIOSes (edit: apparently, memory scrambling is totally useless due to using LFSR for encryption, which can be broken with only 50 bytes of known plaintext, although memory interleaving does complicate things when many DIMMs are in use).
I have read a paper that attacks involving hotswapping against early DDR3 modules are practical, with over 90% of bits recovered, but modern DDR3 and DDR4 modules are supposedly significantly different in implementation, which would likely effect cold boot's efficacy in the wild. Because I know that cold boot attacks against legacy DDR and DDR2 memory are quite trivial, I don't care as much about that, although I would still be interested to see examples of actual uses of cold boot attacks against them regardless, if there's nothing else.
So my question is, in live, criminal computer forensics in the wild, what is the most common form of cold boot attack used today against DDR3 and DDR4 DRAM, and why?
Edit: A possible useful lead is this archived presentation. The summary:
BIOS swap on server PC. Memory acquisition using firewire, reboot or userspace tools is standard. What if your intel motherboard BIOS wipes ECC memory and live plugging PCIe fails?
The presentation describes an alternative way to initialise RAM using methods from the coreboot project. After initialisation the RAM can be dumped compressed over serial and a LPC-USB device.
This makes it sound like removing the memory didn't even cross their minds. In the talk, they said that it was impractical to hotswap the DIMMs, cooling the modules would not be sufficient, and all but the most advanced bus memory analyzers are too slow to analyze live memory, even if they are running as slow as 666 MHz. And of course, wiping memory at POST, usage of ECC, or a BIOS password makes booting into an alternate OS or bootloader to dump memory impossible.