After Princeton’s cold-boot encryption key recovery hack, I got to thinking about what other useful things might be lying around in memory. It’s old news that passwords of logged-in users are hanging out in there, but what about something more useful to the everyday user? What about that file you were editing before accidentally closing its window without saving?

In Linux and on PPC Macs, the root user can access the machine’s ram through the /dev/mem device. I’m not sure why this is unavailable on newer Intel Macs—it’s a bummer.

In theory, if you’re processing some words, spreading sheets, or posting a blog entry and your program crashes, it’s likely that the data you were editing will still be in RAM, unharmed, waiting to be allocated to another process. If you immediately dump the entire contents of RAM to disk before starting another large process, chances are good you can find your data again. It’s tricky though—writing that RAM to disk requires you start up at least one process, such as dd. It’s possible that this new process, or a another process that’s currently running, could allocate memory and obliterate your file. You don’t really have other options, though, so you might try something like this:

dd if=/dev/mem of=/tmp/ramdump
strings /tmp/ramdump | grep "some text in your file"

I found a post by David Keech where he describes exactly this process. He was able to use it to successfully recover the text from a killed vi session:

I tested this by starting vi and typing in “thisisanabsolutelyuniqueteststring”, killing the vi process without saving the file and running the command above immediately with a small modification. Instead of piping the output to a file, I piped it to grep thisisanabsolutelyuniquetest. The grep command found itself, as it always does, but it also found the original string, identified by the rest of the unique string that I didn’t include in the grep command.
You have to be careful when search through running memory. I now remember having this problem with the Mac all those years ago. Whenever I searched for parts of my brother’s letter, I would just end up finding the part of memory that contained the search string.

He also mentions scanning the swap partition, which is also a likely place for your data to be found. It’s the same process, but you replace /dev/mem with /dev/hda2 or whatever your swap partition is.

Here’s the fun part. Based on what we now know about DRAM holding data even a few seconds of being unpowered, you might even be able to use the method to recover program data after a full system crash and reboot. The swap data will for sure be there, but if you reboot into single user mode without starting up X or any large applications, the possibility exists that unallocated areas of /dev/mem will still contain data from before the reboot.

How to recover your data after a crash – Link
Extracting encryption keys after a cold boot – Link

6 thoughts on “Recover data from RAM after a crash

  1. A big thing you can do is e-mail your local power company, or anyone in your local government. Politely ask for a few things: the cancellation of any currently planned coal powered power plants, ask your city to switch to LED traffic lights if they haven’t switched already, and ask your power company to switch to green power.

    You can also buy green power house. Basically you pay a certain amount a month (in NC it’s $4), and a local organization makes it more affordable for local people and companies to buy and maintain green power sources. A 2 kwh solar system costs a good $20,000. It goes a long way toward powering a house, and it should pay for itself in about 15 years, but if you can’t afford it, buying green power is a good alternative. You sign up on your power bill, and when you do this your not only helping local environmentally friendly organizations, your also telling your power company that you’re concerned about what they’re doing for the environment.

    When you’re at the store, buy locally grown produce over food that has been shipped from elsewhere in the country. For the average item it takes about 10 times more calories to transport it to the store than you get from eating it. Also, support local restaurants that buy local food.

    Buy insulation for your light switches and outlets. You loose a lot of hot or cold air in your house simply because it leaks out of small holes in your walls. All you have to do is buy this insulation (available at home improvement stores), pull off the cover, place the insulation, and screw the cover back on. Besides that, try to open windows instead of turning on the AC.

    You can buy carbon offsets from You pay a certain amount of money based on how much carbon you use on average, and the money goes to supporting carbon reducing projects. This is how companies like Whole Foods Market, WalMart and Volkswagen reduce their emissions. Speaking of Whole Foods, if you have one in your area, shop there. They buy local produce when they can, they don’t use plastic bags at the checkout, and they support local environmentally friendly projects.

    Bring your own grocery bag to the store. Whole Foods will give you a 5cent per bag discount, and sells some nice canvas grocery bags that you can use there and elsewhere. However, you can bring your own grocery bag anywhere else too.

    We all do things that are a little wasteful. Keep that in mind, and whenever you catch yourself doing something wasteful (throwing vegetable peels in the garbage, sitting in a parked car with the engine on, etc), make an honest effort to stop. Everything you do helps, no matter how small. The most important thing you can do to help the environment is to be aware, and act on that awareness whenever possible.

Comments are closed.