Collaborate Disseminate
I read "Data Remanence in Semiconductor Devices" by Peter Gutmann, in which it is stated that it is possible to reconstruct the content of an erased SRAM based on changes of properties of the memory cells (thresholds, times).
Doe… Continue reading Data remanence – DDR2
please help me to understand what is this path.
\.\GLOBALROOT\Device\HarddiskVolumeShadowCopy3\pagefile.sys’
Is it related to windows operting system.
Based on my research on internet , found that this has something to do with RAM and… Continue reading \\.\GLOBALROOT\Device\HarddiskVolumeShadowCopy3\pagefile.sys’ [closed]
Are there any non-obvious mitigations for the big DMA-attack revealed last year and demonstrated in this video by F-Secure?
We know that Microsoft has published some material pertaining to DMA-attacks, but, from my reading o… Continue reading Non-obvious Mitigations for This DMA-Attack Demonstrated by F-Secure
I’m trying to interpret this video demonstration by F-Secure of the big cold-boot attack discovered last year.
What is happening at the 50-second mark?
Why does he insert the USB boot-device before doing whatever he does ne… Continue reading Interpreting this F-Secure Video of a DMA-Attack
I’m trying figure out how I can dump the memory associated with a process. So far, I’ve managed to identify the PID’s of the processes I’m interested in (along with their offset). However, I can’t pinpoint the exact Volatilit… Continue reading Volatility: Dumping memory associated with a particular process
I have a Macbook configured with a firmware password required to boot from any media other than the built-in NVMe drive. In theory, this means without my password you can’t boot from removable media. Is this enough to prevent… Continue reading Is setting a firmware password on a Macbook enough to prevent cold boot attacks?
If you remove the drive Tails OS is running on, it will instantaneously shutdown and wipe the RAM.
I know that scripts exist that wipe RAM in Qubes OS but it’s not fully… functional as a security measure. Also it doesn’t s… Continue reading Qubes OS extended security
(Take a Macbook Pro 2017 Sierra 10.12.5 for example.)
What I had done was I downloaded osxpmem-2.1.post4.zip (vouched by ponderthebits.com/.., itself by google.com/..), unzipped it with finder, created a folder Memory_Captures and:
sudo … Continue reading Best strategy to recover running Macbook "modern" Pro ram