/tech/ - Technology★

Since the reboot doesn't cut power, technically not.

However, everything is being initialized a new and the OS does not give out memory pages before clearing it. So practically there is no way of recovering any of that information without having kernel level access.

>>1030996

Doesn't a reboot go through the whole power cycling and BIOS again, specifically to ensure that the state will be identical to what it would be after a cold boot?

>>1030997

Whether it power cycles or not depends on the Motherboard. In my case (laptops, Desktops) it doesn't power cycle.

You can't magically set RAM to clear. You have to zero out the cells. That takes a long time. So unless power to RAM is cut, nothing will clear it.

Modern kernels pre-zero parts of ram and keep it as a "hot spare" to give to programs who request it to save on latency. There is a great talk on this, though I can't remember where. (I believe it was analyzing why GNU's yes is so fast)

>>1031006

>You can't magically set RAM to clear.

The info I can find says refresh time for a cell in the DDR standard is 64 ms max, so I would expect a sub-second power cycle to completely clear the data.

>>1031010

>DDR standard

64ms max?

Holy shit that's horrible. Today's clear times are measured in nano seconds.

A RAM cell holds a single bit.

8gb of RAM = 8,589,934,592 byte = 68,719,476,736 bits stored in cells.

You can only access one RAM channel at ones. You can queue commands, but cannot make them execute parallel. So in single channel mode this would be a worst cause scenario of 140 years.

You can clear RAM by the speed of it's write bandwidth. Intel lists 68gbit/s as the theoretical max for DDR4 with all channels exhausted and the max rated ram speed.

So in the best cause scenario (quad channel included) it would take a second to clear 8gb ram.

In reality we have bigger capacities, not quad channel and slower rated speeds, so expect 16gb of ram to clear in 5 - 10 seconds.

>>1031013

>Holy shit that's horrible. Today's clear times are measured in nano seconds.

The specs have a lot of additional info on how a full cell clear has to be spluit up in over 8k smaller clears, which are then split up even further.

I doubt they were talking about individual bits, "cells" are probably much larger units and defined somewhere else in the spec.

>>1031028

>"cells" are probably much larger units and defined somewhere else in the spec

No. Absolutely no. It's a clearly defined as something that can only hold a single bit.

Doesn't matter if the spec allows you to pack multiple things. The clear has to be written and that happens at the max possible write speed.

>>1031010

>refresh time for a cell in the DDR standard is 64 ms max

It's lower in practice. Refresh period is defined by tREF/tREFI timing which stands for DRAM refresh interval. For DDR3-1333, JEDEC standard sets it to 5200, and that is about 7.8ms. Higher frequency standards increase tREF accordingly to maintain 7.8. Some DIMM modules will tolerate the period being bumped to 20ms, but it depends in ICs, temperature, and voltage. I have some Samsung HCH9 based DDR3 sticks that don't like going beyond 16ms. If the refresh period is too large, the charge in the cells will deteriorate, and data corrupts. I doubt the CPU IMC/MoBo MC keeps constantly refreshing memory without skipping a single beat even during the reboot cycle, so while it won't be clean as in zeroed out, the data also won't be pristine.

>>1031006

>You can't magically set RAM to clear.

Some server/workstation firmware will clear on boot if memtest is enabled.

>>1030984 (OP)

Most of the time, yes.

>>1030984 (OP)

Fast startup or fastboot just dumps the startup stuff loaded on the RAM into your disk and during boot up it just dumps back what's on the disk into your RAM so rebooting on windows won't do.

But most of the time it is up for your mobo to decide not to mention if that mobo is glow.

>>1031010

>>1031013

>>1031041

That refresh time specification is about how frequently it needs to be refreshed in order to reliably maintain full data integrity. It is not any sort of guarantee that all the data will be gone, which is likely to take much longer

>>1031350

>much longer

How much longer though? If I remember right, a cell is considered charged (logical one) if the voltage of the charge in it is higher than Vref, and if the voltage dips below Vref, the cell counts as discharged (a zero respectively). Vref normally is half of VDDQ, so refresh interval can be described as denoting the time it would take for at least one cell to lose half the voltage of its charge under normal conditions. The standard obviously has a very safe time estimate of that, but the need to be constantly refreshed limits throughput of DRAM, so I doubt the actual refresh limit is, say, an order of magnitude bigger. Once the voltage in all cells drops below Vref, the module is effectively clean.

>>1032122

>Our findings show that even if the computer is switched off but not removed from the mains, the data are preserved.

>The observation that the computer’s volatile memory can maintain content for certain seconds even minutes after shut down of power supply, was recently confirmed by a team of researchers from the University of Princeton (Halderman et al., 2008).

>For example, a login password, stored in RAM even for a small period after system shutdown, could be retrieved by rebooting the system while using a custom kernel, or by the moving memory modules into another computer ready to copy all data stored in them (Halderman et al., 2008).

So unless a full memory flush is performed at shutdown, the data retention after warm boot (and possibly even after cold boot following a short power off duration) is good enough for bioluminescent melanin hoarders to bother extracting. Answers OP's question.

why not clear memory the same way you would clear a hard drive

make a ramfs

dd if=/dev/zero bs=4096 of={ramfs}

I don't know what happens when it maxes out your ram, probably starts swapping

if you have a swap maybe only write enough data to ramfs to max memory and a tiny bit of swap so the system doesn't totally crash.

https://en.wikipedia.org/wiki/Dynamic_random-access_memory#Data_remanence

If I remember correctly shutting down and waiting 15 minutes should be enough.

>>1032149

This will not clear memory of open applications/the operating system.

>>1032160

>This will not clear memory of open applications/the operating system.

of course this wouldn't clear any open applications, they are open and running.

this could be hooked into the shutdown sequence somewhere. most of the shit that people care to be wiped would be applications in userland, once that's all closed during a shutdown this could be run to clear memory

>>1032136

>>1032149

The Tails project have done work on this. The residual operating system complicates the task greatly, so the most effective approach is to have the final shutdown action of the OS be to kexec into a new single-purpose "kernel", dedicated to the function of wiping RAM then shutting down or rebooting. They tried modifying memtest86+ for this purpose, and it was pretty effective. I'm not sure where they are with it now:

https://tails.boum.org/blueprint/more_efficient_memory_wipe/

>>1032130

>Boasts about funding ZOG, and thinks only pedos would want data security.

You must be new here.