Say, for example, you have a laptop with encrypted drives so data can't be pulled from those drives if they are physically removed from the device. If you close the lid of the laptop, thus locking it (presumably being protected with a strong password), and someone steals the laptop, can they pull data from the RAM of the laptop? The device is still running so I would presume that data is kept in RAM when it is locked, and is only lost at power-off. Presumably one would have to gain hardware access to the RAM whilst it is in the running device, but I don't know if this is possible. I would wager a guess that it would require physically modifying the motherboard while in use to tap off of the RAM bus to read from it?
Yes! There are several techniques for this.
- The classic is the "cold-boot attack" mentioned in a comment. The machine is forcibly rebooted to a lightweight OS that doesn't wipe memory on startup, and immediately dumps all data from physical RAM (it generally takes at least a few seconds after power loss for data in RAM to be lost).
- There's the option of physically accessing the RAM. The most common approach there is to spray the physical modules with a cryogenic liquid, as extreme cold increases unpowered data retention time significantly (up to minutes); the attacker than simply unmounts the RAM and connects it to a device that dumps it to persistent storage.
- Alternatively, if the RAM pins are exposed, the attacker can connect a device that will keep the RAM powered even after the motherboard loses power, and then cut machine power and access the data directly (this requires more hardware than the other approaches but works even if e.g. the RAM is soldered to the motherboard and the firmware is configured to disallow booting unknown operating systems).
As a general rule, if you're using disk encryption, you should disable suspend-to-RAM (a.k.a. sleep). Suspend-to-disk (hibernate) is fine; the system fully powers off when hibernated so the RAM loses data quickly (and the OS can even deliberately wipe the data as the last step).
There are some mitigations against this. For example, if the data on the RAM is also encrypted using any sort of hardware security module (TPM, Secure Enclave, etc.) that is sensitive to power loss, you might be able to prevent an attacker from obtaining useful data out of the RAM. If the data on the disk is encrypted using an HSM, then the key need not be in (physically accessible) RAM at all. Still, as a general rule, if a device is only locked (at the OS level) / in sleep mode, encryption should not be assumed effective against a sophisticated attacker.