Re:SSD firmware destroys digital evidence, researchers find
by kragen on Saturday March 05, 2011 @12:28PM
(#2291835)
What is this about collecting RAM? Are you saying that if someone's office gets audited for compliance, they'll power off their machines, freeze-spray their DIMMs, extract them, and put them into a DIMM reader to image the RAM contents?
[ Parent
| on HN ]
Re:SSD firmware destroys digital evidence, researchers find
by kovar on Saturday March 05, 2011 @12:38PM
(#2291864)
When collecting evidence from computers, the policy used to be "power it down, and do dead-drive forensics". Over the last few years, this has shifted to "grab RAM and only then consider powering it down."
Memory contains all sorts of potential evidence, from encryption keys to malware to passwords. Failing to collect this information can significantly hamper or even kill an investigation.
The research into freezing and then extracting RAM contents was interesting, but not terribly practical.