What forensic analysis techniques target computer components other than the hard drive once the device is powered off?

  • 1
    Non-volatile random-access memory (NVRAM) can be looked at.
    – DarkMatter
    Mar 6 '19 at 22:50

RAM contents

If it's soon after the device is powered off, there are attacks that may allow to recover RAM content, e.g. Cold Boot Attack on Wikipedia, Memory forensic data recovery utilising RAM cooling methods.

There are also some secondary things that come to mind e.g. serial numbers might be used to trace where and when (and thus by whom) parts were purchased; and there might be a firmware trace showing when the system was last used (which may be important evidence in certain cases) but that feels a very niche use case.

  • 4
    I'd also include mac addresses, which, combined with some network logs, might be used as evidence that the system was used on a specific network or committed some action on that network. Mar 6 '19 at 23:39
  • Note that "soon" often means "within one or two seconds of power loss" for modern DDR3/DDR4 memory.
    – forest
    Mar 7 '19 at 9:08
  • @forest the studies I quoted claim that with certain actions (i.e. rapid cooling) that time can be significantly extended, up to multiple hours. But yes, it essentially means that you need physical access while the power is still on.
    – Peteris
    Mar 7 '19 at 9:13
  • @Peteris Indeed. Sufficient cooling can extend it quite a bit, but if you arrive with the machine off, you can't possibly be fast enough to retrieve the RAM contents.
    – forest
    Mar 7 '19 at 9:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.