RE: forensics Digest 17 Jun 2005 15:04:36 -0000 Issue 499

Vladis,

Farmer and Venema address this question in their book (Forensic Discovery,
p. 182).  The long and short of it is that it all depends.  Modern Intel
CPU's tend to have bios settings that clear main memory on restart, but
there are exceptions.  Sun SPARC's and Apple G4's typically do not clear
main memory.

So, to answer the question you really have to test with the specific
hardware in question.

Regards,

George.

-----Original Message-----
From: Valdis.Kletnieks@vt.edu [mailto:Valdis.Kletnieks@vt.edu] 
Sent: Wednesday, June 22, 2005 5:12 PM
To: tearsong
Cc: forensics@securityfocus.com
Subject: Re: forensics Digest 17 Jun 2005 15:04:36 -0000 Issue 499 

Way back when, some friends of mine were doing research on RAM chips(*), and
we
found out the hard way that at least for some technologies, the state of a
given cell after a power cycle could be dependent on its state before power
cycling happened.  Took quite a while to debug that one - we'd made the rash
assumption that a RAM memory chip started out as either all-zeros or
all-ones,
depending how the cells were tied.  Peter Gutmann also mentions it in
sections
7 and 8 of his paper
http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html

(*) J. Bisgrove, J. Lynch, P. McNulty, W. Abdel-Kader, V. Kletnieks,
W. Kolasinski: "Comparison of soft errors induced by heavy ions and
protons". IEEE Transactions on Nuclear Science, Vol NS-33, No. 6,
p. 1571 (6 Dec 1986)