RAM ......how long is it there?

RAM ......how long is it there?

Post by Sta » Thu, 14 Aug 2003 07:53:20



Hi

I have just been watching a program on forensic computer work...all
very interesting...File slack, RAM slack..etc

One thing did occur to me, although I was already aware that you have
to really go some to completely remove data from the Hard Disk...no
one ever mentions the RAM.

I think I am right in saying that the RAM "wipes" when you shut
down....but is this a proper clean up...or is it possible to get
information off RAM at a later date, as it is with HD's.

I really would like an answer to this, so any thoughts are welcome.

Thanks in advance

Stewart

p.s If this isn't the right group for this question, can someone
please point me in the direction of a better one..thanks.

 
 
 

RAM ......how long is it there?

Post by R.Wiese » Thu, 14 Aug 2003 08:08:51




Quote:> Hi

Hello Stan,

Quote:> I have just been watching a program on forensic computer work...all
> very interesting...File slack, RAM slack..etc

> One thing did occur to me, although I was already aware that you have
> to really go some to completely remove data from the Hard Disk...no
> one ever mentions the RAM.

> I think I am right in saying that the RAM "wipes" when you shut
> down....but is this a proper clean up...or is it possible to get
> information off RAM at a later date, as it is with HD's.

> I really would like an answer to this, so any thoughts are welcome.

Think of the RAM used in PC's as little water-buckets, with a hole in the
bottom.  And a *lot* of them (every bit is a bucket).

When you fill a bucket, you have to return shortly to it, to check & see if
it should contain any water.   The empty ones you leave empty, but you have
to re-fill the partially drained ones again, otherwise they will be empty
shortly ...

And that's what actually happens with the type of RAM used in PC's too.
They contain capacitors for every bit, and you either charge them with
electricity, or not.  But that electric charge will drain away (within a
mili-second or so), so you have to check-and-refill within a certain time,
or otherwise the charge will be gone totally.  This check-and-refilling is
called refreshing.
It's generic name is derived from this continous action of refilling :
dynamic RAM.

So, when you either stop the refresh or the disconnect the power to this
memory, the charge in the individual bit-cells will be gone in a matter of
less than a second.

The answer to your question is therefore : Leave the computer off for a few
minutes (just to be sure the RAM has really been without power and/or
refresh-cycles ), and there is no chance you will ever get anything out of
it that resembles what was there before you switched it off.

In short : No :-)

Regards,
  Rudy Wieser

 
 
 

RAM ......how long is it there?

Post by Sta » Thu, 14 Aug 2003 18:16:36


Thanks a lot, that has cleared it all up for me......was a bit worried
when you started talking about water buckets...but you pulled it all
together in the end :)

Really appreciate it.

Stewart




> > Hi

> Hello Stan,

> > I have just been watching a program on forensic computer work...all
> > very interesting...File slack, RAM slack..etc

> > One thing did occur to me, although I was already aware that you have
> > to really go some to completely remove data from the Hard Disk...no
> > one ever mentions the RAM.

> > I think I am right in saying that the RAM "wipes" when you shut
> > down....but is this a proper clean up...or is it possible to get
> > information off RAM at a later date, as it is with HD's.

> > I really would like an answer to this, so any thoughts are welcome.

> Think of the RAM used in PC's as little water-buckets, with a hole in the
> bottom.  And a *lot* of them (every bit is a bucket).

> When you fill a bucket, you have to return shortly to it, to check & see if
> it should contain any water.   The empty ones you leave empty, but you have
> to re-fill the partially drained ones again, otherwise they will be empty
> shortly ...

> And that's what actually happens with the type of RAM used in PC's too.
> They contain capacitors for every bit, and you either charge them with
> electricity, or not.  But that electric charge will drain away (within a
> mili-second or so), so you have to check-and-refill within a certain time,
> or otherwise the charge will be gone totally.  This check-and-refilling is
> called refreshing.
> It's generic name is derived from this continous action of refilling :
> dynamic RAM.

> So, when you either stop the refresh or the disconnect the power to this
> memory, the charge in the individual bit-cells will be gone in a matter of
> less than a second.

> The answer to your question is therefore : Leave the computer off for a few
> minutes (just to be sure the RAM has really been without power and/or
> refresh-cycles ), and there is no chance you will ever get anything out of
> it that resembles what was there before you switched it off.

> In short : No :-)

> Regards,
>   Rudy Wieser

 
 
 

RAM ......how long is it there?

Post by R.Wiese » Thu, 14 Aug 2003 21:01:15




Hello Stan,

Quote:> Thanks a lot, that has cleared it all up for me......was a bit worried
> when you started talking about water buckets...but you pulled it all
> together in the end :)

I did not know if you would know what a "capacitor" or an "electric charge"
is , so I thought it wise to start with a real-world example ...

Quote:> Really appreciate it.

You're welcome :-)

Regards,
  Rudy Wieser

 
 
 

RAM ......how long is it there?

Post by Ben Peddel » Fri, 15 Aug 2003 00:38:10





>>Hi

> Hello Stan,

>>I have just been watching a program on forensic computer work...all
>>very interesting...File slack, RAM slack..etc

>>One thing did occur to me, although I was already aware that you have
>>to really go some to completely remove data from the Hard Disk...no
>>one ever mentions the RAM.

>>I think I am right in saying that the RAM "wipes" when you shut
>>down....but is this a proper clean up...or is it possible to get
>>information off RAM at a later date, as it is with HD's.

>>I really would like an answer to this, so any thoughts are welcome.

> Think of the RAM used in PC's as little water-buckets, with a hole in the
> bottom.  And a *lot* of them (every bit is a bucket).

> When you fill a bucket, you have to return shortly to it, to check & see if
> it should contain any water.   The empty ones you leave empty, but you have
> to re-fill the partially drained ones again, otherwise they will be empty
> shortly ...

> And that's what actually happens with the type of RAM used in PC's too.
> They contain capacitors for every bit, and you either charge them with
> electricity, or not.  But that electric charge will drain away (within a
> mili-second or so), so you have to check-and-refill within a certain time,
> or otherwise the charge will be gone totally.  This check-and-refilling is
> called refreshing.
> It's generic name is derived from this continous action of refilling :
> dynamic RAM.

> So, when you either stop the refresh or the disconnect the power to this
> memory, the charge in the individual bit-cells will be gone in a matter of
> less than a second.

> The answer to your question is therefore : Leave the computer off for a few
> minutes (just to be sure the RAM has really been without power and/or
> refresh-cycles ), and there is no chance you will ever get anything out of
> it that resembles what was there before you switched it off.

If you use software, then there is no chance of recovery after about 10
minutes to an hour. If, however, you use hardware, then it could be
possible to see what was in memory before being switched off, since the
charges stress the capacitors.

I've got a sort of a screenshot of my Windows desktop in my video card
memory after being switched off for 1 minute. I think you'll be surprised.
It's a big * 1600x900 image, at
http://www.veryComputer.com/

- Show quoted text -

Quote:> In short : No :-)

> Regards,
>   Rudy Wieser