Ubuntu offers full disk encryption relying on luks. An often recurring area of criticism is the fact that Ubuntu disables hibernation by default while suspend-to-ram stores the private keys in the ram memory. However I wonder if this risk is meaningful in practice.
If your laptop is locked (ie showing the login screen), or the lid of your laptop is closed (and your laptop is configured to wake up on the lock screen). How could someone inspect the content of your RAM without having to reboot your computer?
It seems to me that on the one hand, the attacker cannot switch to single-user mode without rebooting. He cannot even mount an usb key containing a bruteforce script since he does not have mount rights. Similarly he cannot open a shell under your user (or any other user) since your computer is locked.
So my question is, is there a piece of hardware I am unaware of that would allow the content of the RAM to be inspected in an hot manner without needing to power the device off to make hardware modifications?
The scenario I have in mind is the one of a determined adversary stealing a laptop.