Is it possible for RAM to retain any data after power is removed? I don't mean within a few minutes such as cold boot Attacks but rather 24 hours plus.
Working with classified systems the policy always seems to treat RAM the same as disks and must be removed and disposed of according to classification.
Is this a myth which has become standard practice or is there really a data security risk present?
I am assuming regular PC RAM designs over the past 20 years.
This 2013 article analyses retention time for several DRAM chips. Among the relevant information, one may list the following:
Retention time depends on a lot of things, including the values of neighbouring bits. A DRAM bit is a potential well, and it loses its contents by moving charges from or into neighbouring areas, so whether there is room in these neighbours matters.
Temperature is very important for retention time (which is why cold-boot attacks insist on cold: if you plunge the machine in liquid nitrogen, you can keep the charges in place for substantially longer).
At room temperature, typical retention time is counted in milliseconds, at best a few seconds, and, more importantly, the discharge is exponential in nature (it goes in e-Ct for some constant C), as could be expected (capacitors also work that way). So the remaining charge after 2 minutes will be half that after 1 minute; after 10 minutes you are down to a thousandth of the initial charge; after 20 minutes, a millionth; after 30 minutes, a billionth.
To sum up: 24 hours... forget it. You won't find meaningful data in DRAM that has been kept unpowered, at room temperature, after 24 hours (even if the room is, say, in Canada).
This is for DRAM, where a stored bit can be envisioned as a charged capacitor. This is the kind of RAM commonly found in PC for the last 20 years.
There also exists SRAM, where each bit is stored as the current state of a bistable circuit that consists in 6 transistors. SRAM is substantially faster than DRAM; it is also a lot more expensive. In PC, SRAM is used for cache (usually integrated in the CPU). Without power, SRAM loses any trace of its contents within microseconds.
There are some stories about bits being "burned" into RAM when the same value is stored for a long time in a specific emplacement in a chip. To the best of my knowledge, these stories are exactly that: stories. They come from "thought by analogy", by people who think of RAM in the same way as they think about CRT displays (which could have "burn-in" effects, hence the development of "screensavers"). I am not aware of any case where such stories were ever substantiated.
But fears and doubts are powerful forces that cannot always be dispelled by the strongest logic.
There are mechanisms that could result in data remanence in DRAM beyond the charge stored in the gates (which is typically gone in seconds, especially at normal elevated operating temperature). One is movement of ionic contaminants which can cause slight shifts in thresholds. This could be the 'burn in' that Tom's answer refers to. There may not be any practical way to recover data, but I don't think we can dismiss the possibility out-of-hand.
There is a paper on it here. Data Remanence in Semiconductor Devices Peter Gutmann IBM T.J.Watson Research Center
In theory any device can store anything, because it is speced to meet an interface, not spec'd for its implementation. Realistically speaking, the answer is more murky. This, by the way, is where SSD's get so interesting because there is no accepted way to tell a SATA SSD to "wipe everything" (edit: no way that is reliably trustworthy, at least)
From what I understand, with any classified hardware, one has "declassification instructions" to declassify the hardware after it is no longer needed. These typically come in the form of a letter from the vendor indicating what operations must be taken before the vendor considers the data irrecoverable. For many devices, this comes in the form of "unplug from power for X seconds," indicating the range of time the government feels memory is volatile enough to warrant special handling. For a long time, the process for harddrives was to run a particular series of wipes, but the process was so brutal few harddrives survived, so they were often just destroyed instead.
One reason one may elect to destroy hardware rather than declassify it is if the cost of acquiring those letters from the vendor is too great compared to the value of the product. If a server farm's worth of RAM is expected to be worth a mere $1000 after depreciation, it might be cheaper to just throw it in the wood chipper when you're done.
Final detail: how valuable is your product? If its worth a mere $10 million dollars, you'll find unplugging the ram at room temperature for a minute or two more than sufficient. If its' worth several hundred billion, you may want to consider the wood chipper. If it's beyond monetary cost, well, its your threat model. Do as you see fit.
No. Though the UK may differ, the US seems to be just fine with simple power removal for sanitizing RAM in classified systems. NSA/CSS Policy Manual 9-12 states:
Sanitize DRAM (dynamic random-access memory), SRAM (static random-access memory), and Volatile FPGA by removing the power, including backup batteries. Once power is removed, sanitization is instantaneous.
Check the Solid State Storage section here.
In theory data can be recovered as individual bit probabilities (ie 62% 1) by measuring the time it takes a given bit to drop to logic 0 without refresh. This was feasible up to about 256MB RAM but the newer geometries are so small (<50nm) that the number of electrons makes this unfeasible. About the only use would be recovering partial encryption keys prior to bruteforcing to reduce the keyspace, ie 50% of a 2048 bit RSA key with reasonable fidelity would reduce the time to break it by a few years. Note that this still requires a massive stroke of luck such as immediately powering off the system under attack and reinitializing the memory at <-70C within 5 minutes in a specialist test jig with analogue circuitry to read back the subtle timings needed.
I have heard of cases where data was accidentally written to the SPD chip and then erased, these chips are low density Flash and potentially recoverable with the right tools even if the RAM itself is wiped.
A RAM is a set of transistors and capacitors. Transistors are used to amplify -electrical- signals, whereas the capacitors store properly said the data temporally. The information stored by such elements is volatile, meaning it can not be available after few (5 approximately) minutes after it is powered off.
I hate adding this so long after the fact but it is important for people working in security to consider after reading the comments above.
User (WhatPlantsCrave) posted good info about SRAM and I wanted to give more about where you will find this memory and another common name people use.
NVRAM or non-volatile RAM (also SRAM mentioned above) will retain data until it is deleted or disconnected from the battery. Appliance related equipment such as switches, routers, other equipment often use NVRAM to store configurations. These configurations will often have the passwords (either in clear text or a hash). Administrators can and should use secret levels to secure the password in a hash in most cases. The issue can arise when older equipment is donated or placed in the trash with the SRAM and internal battery intact. If a person or group were determined enough they could potentially get that password or the hash (running the hash against a rainbow table) and get enough information to be a threat to your organization. There are many other scenarios, designs, and things to consider.
The point of this post is to be aware when you are clearing out old equipment and to consider the potential of SRAM being in the device.
