6 ms·
Just killing a process will leave its core intact in memory until the pages are reused by the operating system. If the computer is then hibernated (and by defau
by a-priori 18y ago
Just killing a process will leave its core intact in memory until the pages are reused by the operating system. If the computer is then hibernated (and by default Mac OS X writes hibernation data when you suspend it), a memory dump is written to disk that may include this data. If a process was manipulating sensitive data -- cleartext passwords, cryptographic keys, or so forth -- then that data may be persisted even after a program is killed.
The good thing is that, as far as I know, most operating systems use a first-in first-out page allocation algorithm. This means that newly-freed pages will be given out first, so the life-span of this "zombie data" will probably be short.
Also good news is that RAM is volatile by nature, so it doesn't store "imprints" like hard drives may after a write. If a byte of RAM is overwritten, all traces of the old data is gone within a few nanoseconds. This means that if you are paranoid about this sort of data leak, you should zero sensitive memory buffers before returning them to the system.
I know a bit about the analagous problems with hard drives, if you're interested.
- otto 18y agoThough RAM is volatile it is possible to get data off of it. I've heard of techniques of using extreme cold temperatures to slow the clearing of data. I think there are papers on this referring to it as "Low temperature data remanence"