Assuming a full disk encrypted system where non-volatile storage is encrypted.
While the system is running, in case of a crash and memory dump, e.g. plugging a USB drive causing an IRQL_NOT_LESS_OR_EQUAL error, what are the risks that the encryption keys are contained in that memory dump file?
As a variation, assume an environment where you have an encrypted container sitting open, and the system crashes at that moment.
In any scenarios where there's something encrypted on disk but decrypted on-the-fly while the system is running, and a system crash occurs, are there risks that the memory dumps contain encryption keys or something that would lead to them ?
The above scenario just happened to me, and I have done a local analysis.
I opened %SystemRoot%\MEMORY.DMP with a hex editor, and looked for passwords or passphrases but didn't find them. However, is it possible that they are still contained in another form, or that there is something leading to finding them out?