Maybe they're running some sort of daemon that wipes RAM when the USB is pulled out, it's still possible to get the data if the OS hasn't shut down. I wonder if

Maybe they're running some sort of daemon that wipes RAM when the USB is pulled out, it's still possible to get the data if the OS hasn't shut down. I wonder if something like that exists. From the TAILS docs: "Moreover, an attacker having physical access to the computer while Tails is running can recover data from RAM as well. To avoid that, learn the different methods to shutdown Tails rapidly." -- https://tails.boum.org/doc/advanced_topics/cold_boot_attacks/index.en.html https://tails.boum.org/doc/advanced_topics/cold_boot_attacks... EDIT: Seems tails does have such a daemon (https://tails.boum.org/doc/first_steps/shutdown/index.en.html https://tails.boum.org/doc/first_steps/shutdown/index.en.htm...) so if it completes shutdown, the RAM should have been overwritten and unreadable.