3 ms·

Out of curiosity, does data persist after a shutdown when an OS runs on RAM? Are there dumps to a HDD?

monocasa 7y ago
Nope. The piratebay used to run their servers like this. They'd boot off of a USB stick, pivot root to a ram disk, and then unmount the USB stick. Then when the cops would seize the machines and cut power to save as much evidence as they could, they'd actually be doing the opposite.
- hnarn 7y ago
  > Then when the cops would seize the machines and cut power to save as much evidence as they could, they'd actually be doing the opposite. Let's for a second assume that forensic computer technicians aren't completely incompetent and actually understand that you do not pull the plug on a system that potentially contains evidence the first thing you do. While this has been known to happen in the past, I can almost guarantee it's because of "helpful" police officers, much in the same way the job of any forensic technician can be ruined by good intentions of those who don't know better.
  - monocasa 7y ago
    Lol, forensic technicians are pretty incompetent overall. Like I remember a peer reviewed article on PS3 forensics where they explicitly have a section on trying to run a PS3 disk image in VMWare and didn't understand why they couldn't get it to work. And this piratebay mitigation was in the early 2000s. At that point most of the anti forensic mitigations were booby traps on input channels (keyboard, console, etc) and maybe a tilt sensor that'd wipe the drive if anyone tried to access it. Under that scheme, pulling power before inspection is what you want to do.
    - hnarn 7y ago
      > Under that scheme, pulling power before inspection is what you want to do. Why? Are you saying there were no measures to make data inaccessible in case of power failure?
ww520 7y ago
Unfortunately no. All data in the RAM disk are gone. You can mount a HDD after boot up to save data if needed.

Nope. The piratebay used to run their servers like this. They'd boot off of a USB stick, pivot root to a ram disk, and then unmount the USB stick. Then when the cops would seize the machines and cut power to save as much evidence as they could, they'd actually be doing the opposite.

hnarn 7y ago
> Then when the cops would seize the machines and cut power to save as much evidence as they could, they'd actually be doing the opposite. Let's for a second assume that forensic computer technicians aren't completely incompetent and actually understand that you do not pull the plug on a system that potentially contains evidence the first thing you do. While this has been known to happen in the past, I can almost guarantee it's because of "helpful" police officers, much in the same way the job of any forensic technician can be ruined by good intentions of those who don't know better.
- monocasa 7y ago
  Lol, forensic technicians are pretty incompetent overall. Like I remember a peer reviewed article on PS3 forensics where they explicitly have a section on trying to run a PS3 disk image in VMWare and didn't understand why they couldn't get it to work. And this piratebay mitigation was in the early 2000s. At that point most of the anti forensic mitigations were booby traps on input channels (keyboard, console, etc) and maybe a tilt sensor that'd wipe the drive if anyone tried to access it. Under that scheme, pulling power before inspection is what you want to do.
  - hnarn 7y ago
    > Under that scheme, pulling power before inspection is what you want to do. Why? Are you saying there were no measures to make data inaccessible in case of power failure?

ww520 7y ago

Unfortunately no. All data in the RAM disk are gone. You can mount a HDD after boot up to save data if needed.