62

Is it possible for RAM to retain any data after power is removed? I don't mean within a few minutes such as cold boot Attacks but rather 24 hours plus.

Working with classified systems the policy always seems to treat RAM the same as disks and must be removed and disposed of according to classification.

Is this a myth which has become standard practice or is there really a data security risk present?

I am assuming regular PC RAM designs over the past 20 years.

71

This 2013 article analyses retention time for several DRAM chips. Among the relevant information, one may list the following:

  • Retention time depends on a lot of things, including the values of neighbouring bits. A DRAM bit is a potential well, and it loses its contents by moving charges from or into neighbouring areas, so whether there is room in these neighbours matters.

  • Temperature is very important for retention time (which is why cold-boot attacks insist on cold: if you plunge the machine in liquid nitrogen, you can keep the charges in place for substantially longer).

  • At room temperature, typical retention time is counted in milliseconds, at best a few seconds, and, more importantly, the discharge is exponential in nature (it goes in e-Ct for some constant C), as could be expected (capacitors also work that way). So the remaining charge after 2 minutes will be half that after 1 minute; after 10 minutes you are down to a thousandth of the initial charge; after 20 minutes, a millionth; after 30 minutes, a billionth.

To sum up: 24 hours... forget it. You won't find meaningful data in DRAM that has been kept unpowered, at room temperature, after 24 hours (even if the room is, say, in Canada).


This is for DRAM, where a stored bit can be envisioned as a charged capacitor. This is the kind of RAM commonly found in PC for the last 20 years.

There also exists SRAM, where each bit is stored as the current state of a bistable circuit that consists in 6 transistors. SRAM is substantially faster than DRAM; it is also a lot more expensive. In PC, SRAM is used for cache (usually integrated in the CPU). Without power, SRAM loses any trace of its contents within microseconds.


There are some stories about bits being "burned" into RAM when the same value is stored for a long time in a specific emplacement in a chip. To the best of my knowledge, these stories are exactly that: stories. They come from "thought by analogy", by people who think of RAM in the same way as they think about CRT displays (which could have "burn-in" effects, hence the development of "screensavers"). I am not aware of any case where such stories were ever substantiated.

But fears and doubts are powerful forces that cannot always be dispelled by the strongest logic.

  • 8
    You are right with saying it's exponential, but apply that wrongly (but overly optimistic, which is fine): Your calculations for 2 and ten minutes are based on the assumption that in the first minute only half the charge is lost - whereas you just said the retention time is counted in milliseconds or seconds. – Hagen von Eitzen Sep 9 '15 at 20:31
  • 4
    I encountered a design for burned RAM. Somebody figured out how to adjust the null potentials of RAM so it would come up with a pre-loaded image on powerup without needing a separate ROM chip. Don't know if it ever got used. – Joshua Sep 9 '15 at 21:44
  • 14
    "people who think of RAM in the same way as they think about CRT displays" -- speaking of which, does the military in fact dispose of CRTs from classified systems by thorough destruction, just in case classified information is burned into them? – Steve Jessop Sep 10 '15 at 7:47
  • 3
    lol @ the ram being in Canada. Both funny and depressing comment as I prepare for at least 8 months of cold. – user7933 Sep 10 '15 at 20:26
  • 2
    Interested but unrelated side note: once upon a time you probably could burn in to RAM like you can with a CRT because at one time CRTs were actually used as RAM. en.wikipedia.org/wiki/Williams_tube – Kaithar Sep 11 '15 at 0:50
21

There are mechanisms that could result in data remanence in DRAM beyond the charge stored in the gates (which is typically gone in seconds, especially at normal elevated operating temperature). One is movement of ionic contaminants which can cause slight shifts in thresholds. This could be the 'burn in' that Tom's answer refers to. There may not be any practical way to recover data, but I don't think we can dismiss the possibility out-of-hand.

There is a paper on it here. Data Remanence in Semiconductor Devices Peter Gutmann IBM T.J.Watson Research Center

  • 11
    @GuntramBlohm To me this sounds like an answer. Paraphrased, it says: "There's no commonly known way to extract the data, but there's enough risk to dispose of ram carefully if people could die if the data leaked." – Patrick M Sep 10 '15 at 17:08
6

In theory any device can store anything, because it is speced to meet an interface, not spec'd for its implementation. Realistically speaking, the answer is more murky. This, by the way, is where SSD's get so interesting because there is no accepted way to tell a SATA SSD to "wipe everything" (edit: no way that is reliably trustworthy, at least)

From what I understand, with any classified hardware, one has "declassification instructions" to declassify the hardware after it is no longer needed. These typically come in the form of a letter from the vendor indicating what operations must be taken before the vendor considers the data irrecoverable. For many devices, this comes in the form of "unplug from power for X seconds," indicating the range of time the government feels memory is volatile enough to warrant special handling. For a long time, the process for harddrives was to run a particular series of wipes, but the process was so brutal few harddrives survived, so they were often just destroyed instead.

One reason one may elect to destroy hardware rather than declassify it is if the cost of acquiring those letters from the vendor is too great compared to the value of the product. If a server farm's worth of RAM is expected to be worth a mere $1000 after depreciation, it might be cheaper to just throw it in the wood chipper when you're done.

Final detail: how valuable is your product? If its worth a mere $10 million dollars, you'll find unplugging the ram at room temperature for a minute or two more than sufficient. If its' worth several hundred billion, you may want to consider the wood chipper. If it's beyond monetary cost, well, its your threat model. Do as you see fit.

  • This, by the way, is where SSD's get so interesting because there is no accepted way to tell a SATA SSD to "wipe everything". What about the Secure Erase command, though? – Mehrdad Sep 11 '15 at 16:42
  • @Mehrdad There is the Secure Erase command. However, its actual behavior is unspecified. For the class of individuals worried about ram retaining its contents, the "This command says to erase everything" is insufficient to allay fears. It is currently presumed by many that you need to confer with the vendor to determine if their particular implementation of the Secure Erase command for that particular model is sufficient for one's needs. – Cort Ammon Sep 11 '15 at 17:17
  • Sure but that's not the same as the problem you pointed out in your answer. In the answer you said the problem is that there is no way to TELL the SSD to erase everything, but in your comment you're saying that "telling" is possible, but insufficient. Your comment seems fine but your answer seems wrong. – Mehrdad Sep 11 '15 at 17:47
  • @Mehrdad Good point. I've added an edit to soften the wording a bit. Thanks! – Cort Ammon Sep 11 '15 at 18:53
  • Cool, nice, but now I don't get why this is an SSD issue. Isn't the problem you're mentioning the same for any storage medium -- hard disk, tape, etc.? You're basically saying you can't trust the hardware, and if that's the case then you can't really trust anything ever. – Mehrdad Sep 11 '15 at 19:09
4

No. Though the UK may differ, the US seems to be just fine with simple power removal for sanitizing RAM in classified systems. NSA/CSS Policy Manual 9-12 states:

Sanitize DRAM (dynamic random-access memory), SRAM (static random-access memory), and Volatile FPGA by removing the power, including backup batteries. Once power is removed, sanitization is instantaneous.

Check the Solid State Storage section here.

2

In theory data can be recovered as individual bit probabilities (ie 62% 1) by measuring the time it takes a given bit to drop to logic 0 without refresh. This was feasible up to about 256MB RAM but the newer geometries are so small (<50nm) that the number of electrons makes this unfeasible. About the only use would be recovering partial encryption keys prior to bruteforcing to reduce the keyspace, ie 50% of a 2048 bit RSA key with reasonable fidelity would reduce the time to break it by a few years. Note that this still requires a massive stroke of luck such as immediately powering off the system under attack and reinitializing the memory at <-70C within 5 minutes in a specialist test jig with analogue circuitry to read back the subtle timings needed.

I have heard of cases where data was accidentally written to the SPD chip and then erased, these chips are low density Flash and potentially recoverable with the right tools even if the RAM itself is wiped.

  • For RSA, 50% of the private key would actually make it trivial to break, since even only one of the two primes gives you enough information to calculate the remaining prime with a single division. – forest Nov 2 '18 at 2:57
2

I hate adding this so long after the fact but it is important for people working in security to consider after reading the comments above.

User (WhatPlantsCrave) posted good info about SRAM and I wanted to give more about where you will find this memory and another common name people use.

NVRAM or non-volatile RAM (also SRAM mentioned above) will retain data until it is deleted or disconnected from the battery. Appliance related equipment such as switches, routers, other equipment often use NVRAM to store configurations. These configurations will often have the passwords (either in clear text or a hash). Administrators can and should use secret levels to secure the password in a hash in most cases. The issue can arise when older equipment is donated or placed in the trash with the SRAM and internal battery intact. If a person or group were determined enough they could potentially get that password or the hash (running the hash against a rainbow table) and get enough information to be a threat to your organization. There are many other scenarios, designs, and things to consider.

The point of this post is to be aware when you are clearing out old equipment and to consider the potential of SRAM being in the device.

0

A RAM is a set of transistors and capacitors. Transistors are used to amplify -electrical- signals, whereas the capacitors store properly said the data temporally. The information stored by such elements is volatile, meaning it can not be available after few (5 approximately) minutes after it is powered off.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.