dmiessler.com | grep understanding - Latest Comments in Performing a “Cold-Boot” Proof of Concept Without Princeton’s Bit-Unlocker

Re: Performing a “Cold-Boot” Proof of Concept Without Princeton’s Bit-Unlocker

Michael — Fri, 12 Dec 2008 13:03:24 -0000

Is there a way to make a usb drive in windows that will do the same thing?

Re: Performing a “Cold-Boot” Proof of Concept Without Princeton’s Bit-Unlocker

kamal ahluwalia — Wed, 03 Sep 2008 04:28:35 -0000

hi
i am workin on this information from past one week.can u plz tell me about the execution proceedure or provide some snapshots of your work.
there is a file winen.exe in encase(i.e a forensic software).can it help me.
plz reply

Re: Performing a “Cold-Boot” Proof of Concept Without Princeton’s Bit-Unlocker

Maxo — Thu, 06 Mar 2008 09:56:54 -0000

I read the full paper from Princeton yesterday. From what it said, if you boot up within a second of shut down you should be ok. Depending on the RAM, you could have it off for up to 30 seconds.
The safest bet, apparently, to blow compressed air from an upside down can to cool it and then shut it down and boot it back up.

Re: Performing a “Cold-Boot” Proof of Concept Without Princeton’s Bit-Unlocker

cooperati — Thu, 06 Mar 2008 02:54:29 -0000

variables to be looked at are ram size, manufacturer, and optimal cool down correlation to data fade.

there might be some means by which the industry can eliminate this effect by switching to composites that increase data fade after shut down more rapidly. maybe even the architecture, by using multiple chips instead of one single structure.

please, continue the research. if Princeton isn't interested, I bet that MIT, Harvard, Stanford or Cornell would be.

-=T=-

Re: Performing a “Cold-Boot” Proof of Concept Without Princeton’s Bit-Unlocker

Daniel Miessler — Wed, 05 Mar 2008 23:08:45 -0000

@Arik

True, but I think it's even cooler that it CAN be shut down - even without being cooled - and still will yield data like this.

Re: Performing a “Cold-Boot” Proof of Concept Without Princeton’s Bit-Unlocker

arikb — Wed, 05 Mar 2008 18:02:24 -0000

You don't actually have to shut it down.

You can take a laptop that you, presumably, got illegally in sleep mode, cool its memory chip as it's sleeping; then pop it off its holder and into a new computer with the software.

-- Arik

Re: Performing a “Cold-Boot” Proof of Concept Without Princeton’s Bit-Unlocker

Daniel Miessler — Wed, 05 Mar 2008 15:13:00 -0000

It was shut down.

Re: Performing a “Cold-Boot” Proof of Concept Without Princeton’s Bit-Unlocker

Maxo — Wed, 05 Mar 2008 14:24:31 -0000

Another question, what was the order in which you did everything? Where you able to pull data from the computer after it was completely shut down, or while it was in sleep/hibernate? Or did you have to pull it from the PC while it was running and logged in to?

Re: Performing a “Cold-Boot” Proof of Concept Without Princeton’s Bit-Unlocker

Maxo — Wed, 05 Mar 2008 09:24:30 -0000

I'm very interested to find out what other information you are able to grab from this. The fact that all you need is a USB key with special software is really shocking.
Do you think a person who is only semi-technical could be given these tools and easily trained to pull this information?