how do people recover data from ram?

Question

I'm just curious. I've read about law enforcement and what not recovering incriminating data from ram to get evidence, but how is it done? What kind of equipment would one need to recover files from a stick of ram?

Answer 1

Freeze the chip, pop it into another computer, and run the linux command dd to copy the raw data to disk.

After you have the raw data, copy it to a new partition using dd again and run an undelete program on the partition. Undelete should pull out any files that fall under a recognizable format (ex pictures, etc...). The rest could be further processed but not easily unless you know what you're looking for.

I can't say that I've done this myself but it's not hard to imagine how it's done.

Check out this video that Daniel Beck posted in the comments to see a demonstration of how to crack hard drive encryptions using this method.

Answer 2

You can't (in practice). RAM needs to be constantly refreshed to keep "remembering", when the computer is turned off the charge leaks out after a minute or so.

Form wikipedia

Dynamic random access memory (DRAM) is a type of random access memory that stores each bit of data in a separate capacitor within an integrated circuit. Since real capacitors leak charge, the information eventually fades unless the capacitor charge is refreshed periodically. Because of this refresh requirement, it is a dynamic memory as opposed to SRAM and other static memory.

The main memory (the "RAM") in personal computers is Dynamic RAM (DRAM), as is the "RAM" of home game consoles (PlayStation, Xbox 360 and Wii), laptop, notebook and workstation computers.

The advantage of DRAM is its structural simplicity: only one transistor and a capacitor are required per bit, compared to six transistors in SRAM. This allows DRAM to reach very high densities. Unlike flash memory, it is volatile memory (cf. non-volatile memory), since it loses its data when power is removed. The transistors and capacitors used are extremely small—millions can fit on a single memory chip.

Answer 3

DRAM cells store electrical charges. They are leaky, so as was mentioned, they need to be refreshed.

There are manufacturing tolerances, and the influence of temperature and component age, that will define the ACTUAL time it takes for a DRAM cell to be no longer readable reliably if it has not been refreshed. The refresh specification for a given DRAM chip will actually be a worst case value - something that will keep your data readable with monday-production chips that have been running at maximum temperature for 20 years more or less. In most cases, the cell can keep the data far longer.

In addition, the circuitry inside a DRAM chip decides whether to read the amount of charge in a given cell as "0" or "1" (in some designs, that might be reversed - low charge means "1"). Charge content that is not high enough to be read as "1" is still in the cell - and in some cases, by running the DRAM chip with an out-of-spec operating voltage (which might stress it, or make it far slower, but will not yet destroy it), the threshold voltage on which 1 is decided from 0 can be manipulated temporarily, so some or all cells become readable again.

Also, unless there is actually an output register, there might be subtle voltage or waveform differences even in the quantized (switched to 1 or 0) output signal that can give you a hint at what charge is actually in the cell - comparators (which read amplifiers are) are rarely perfect quantizers, especially if they are built for speed not precision.

Also, if a cell reads unreliably, a determined attacker or forensicist can still use statistics to his advantage (count how many times a 0 or 1 is read, and correlate)...