4 expanded posts ยท every known parent and child
When a running computer is seized in some sort of law enforcement raid, what are the chances someone would think to backup the contents of a RAMDISK drive prior to powering it down?
On Mon, 4 Sep 1995, Anonymous wrote: > Date: Mon, 4 Sep 1995 19:25:07 +0200 > From: Anonymous <anon-remailer@utopia.hacktic.nl> > To: mail2news@utopia.hacktic.nl, cypherpunks@toad.com > Newgroups: alt.security.pgp, alt.politics.org.fbi > Subject: Re: Emergency File Wipe Algorithim > > When a running computer is seized in some sort of law enforcement > raid, what are the chances someone would think to backup the > contents of a RAMDISK drive prior to powering it down? > > Why would you even ask this question? If the odds are > 0 (which they are) they are too high as the solution is simple. A screensaver which shuts down the system entirely if anything but "}" is pressed. If any key but the secret one is pressed by an excited agent, the ramdisk is gone. If the computer is simply powered down, the ramdisk is gone. I suggest, rather than a ramdisk however, an encrypted partition al la CryptDisk or Secure(Drive? Device?). --- 00B9289C28DC0E55 nemo repente fuit turpissimus - potestas scientiae in usu est E16D5378B81E1C96 quaere verum ad infinitum, loquitur sub rosa - wichtig! *New Key Information* - Finger for key revocation and latest key update.
Anon writes> > When a running computer is seized in some sort of law enforcement > raid, what are the chances someone would think to backup the > contents of a RAMDISK drive prior to powering it down? Also note the recent posting on sci.crypt by Peter Gutmann about being able to recover data from DRAMs and SRAMs after powerdown. It hits cryptokeys really bad. I suppose this is really academic at the current stage, but that might change. /Christian
>Also note the recent posting on sci.crypt by Peter Gutmann about being >able to recover data from DRAMs and SRAMs after powerdown. It hits >cryptokeys really bad. If the power is cycled as opposed to turned off only then a memory self test program will probably erase the data. Phill