1

From a computer forensics standpoint. If someone were to mount a partition in RAM using something like: mount -t tmpfs tmpfs /mnt -o size=1024m

How much more difficult would it be to recover data saved there than it would be to recover data saved and erased on a regular harddrive?

Improve this question
3
  • 2
    Depending on how warm/cold the computer is, they would have somewhere between minutes and hours to put the ram into another system (or under liquid nitrogen and similar) before any data is beyond reach. It would also be MUCH faster to clear/overwrite with random data upon shutdown than a hard drive. Hard drives on the other hand will store the data for a long time, and doing a secure erase is much more difficult and time-consuming. I don't even think that this is an apples-to-appples comparison. The hard drive could also potentially be encrypted, AFAIK no ram is.
    – user2813274
    Commented Nov 11, 2014 at 3:39
  • Ram can be encrypted:en.wikipedia.org/wiki/TRESOR is one example.
    – P0LYmath
    Commented Dec 7, 2014 at 2:20
  • @P0LYmath TRESOR does not encrypt RAM, it simply keeps disk encryption keys outside of RAM. There are some RAM-encrypting techniques based on TRESOR though, such as HyperCrypt and RamCrypt, but they did not exist at the time of your comment.
    – forest
    Commented Nov 2, 2018 at 3:13

1 Answer 1

Reset to default
1

It depends.

The kernel can use swapfiles as backing store for a tmpfs filesystem: if the kernel decides that it needs to swap out something to free up physical RAM, the contents of the filesystem are candidates for swapping out, either in whole or in part. If you're lucky (or unlucky), coherent pieces of data will wind up in the swapfile for an investigator to see. Even if parts of the filesystem get swapped out, though, recovering data will be difficult: since the filesystem metadata may not be present and data may be in random order, it's more akin to performing forensics on a memory dump than on a filesystem.

If the computer is still running with the filesystem mounted, it may be possible to perform a DMA attack to recover the contents of RAM. In this case, forensics will be easy, particularly if the swapfile can also be dumped, because the entire structure and contents of the filesystem is accessible.

If the data does not get swapped out and a DMA attack is not possible, the only option is a cold boot attack to try to recover the contents of RAM before it decays.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .