Comments on: Performing a “Cold-Boot” Proof of Concept Without Princeton’s Bit-Unlocker

By: Upholstery Cleaning

Upholstery Cleaning — Wed, 19 Jan 2011 07:15:00 +0000

Great post thanks a lot. Enjoyed reading it!

By: Steam Cleaners

Steam Cleaners — Fri, 26 Jun 2009 06:19:24 +0000

Wow.. It sounds great!! A USB key with a special software is all you need to this was really amaze me.. Thanks for the info..

By: Michael

Michael — Fri, 12 Dec 2008 23:03:24 +0000

Is there a way to make a usb drive in windows that will do the same thing?

By: Michael

Michael — Fri, 12 Dec 2008 18:03:24 +0000

Is there a way to make a usb drive in windows that will do the same thing?

By: Michael

Michael — Fri, 12 Dec 2008 15:03:24 +0000

Is there a way to make a usb drive in windows that will do the same thing?

By: kamal ahluwalia

kamal ahluwalia — Wed, 03 Sep 2008 08:28:35 +0000

hi i am workin on this information from past one week.can u plz tell me about the execution proceedure or provide some snapshots of your work. there is a file winen.exe in encase(i.e a forensic software).can it help me. plz reply

By: kamal ahluwalia

kamal ahluwalia — Wed, 03 Sep 2008 08:28:00 +0000

By: Maxo

Maxo — Thu, 06 Mar 2008 14:56:54 +0000

I read the full paper from Princeton yesterday. From what it said, if you boot up within a second of shut down you should be ok. Depending on the RAM, you could have it off for up to 30 seconds. The safest bet, apparently, to blow compressed air from an upside down can to cool it and then shut it down and boot it back up.

By: Maxo

Maxo — Thu, 06 Mar 2008 14:56:00 +0000

By: TIMM

TIMM — Thu, 06 Mar 2008 07:54:29 +0000

variables to be looked at are ram size, manufacturer, and optimal cool down correlation to data fade.

there might be some means by which the industry can eliminate this effect by switching to composites that increase data fade after shut down more rapidly. maybe even the architecture, by using multiple chips instead of one single structure.

please, continue the research. if Princeton isn't interested, I bet that MIT, Harvard, Stanford or Cornell would be.

-=T=-

By: TIMM

TIMM — Thu, 06 Mar 2008 07:54:00 +0000

variables to be looked at are ram size, manufacturer, and optimal cool down correlation to data fade.

please, continue the research. if Princeton isn't interested, I bet that MIT, Harvard, Stanford or Cornell would be.

-=T=-

By: Daniel Miessler

Daniel Miessler — Thu, 06 Mar 2008 04:08:45 +0000

@Arik

True, but I think it’s even cooler that it CAN be shut down – even without being cooled – and still will yield data like this.

By: Daniel Miessler

Daniel Miessler — Thu, 06 Mar 2008 04:08:00 +0000

@Arik

True, but I think it’s even cooler that it CAN be shut down – even without being cooled – and still will yield data like this.

By: Arik

Arik — Wed, 05 Mar 2008 23:02:24 +0000

You don't actually have to shut it down.

You can take a laptop that you, presumably, got illegally in sleep mode, cool its memory chip as it's sleeping; then pop it off its holder and into a new computer with the software.

-- Arik

By: Arik

Arik — Wed, 05 Mar 2008 23:02:00 +0000

You don't actually have to shut it down.

You can take a laptop that you, presumably, got illegally in sleep mode, cool its memory chip as it's sleeping; then pop it off its holder and into a new computer with the software.

-- Arik

By: Daniel Miessler

Daniel Miessler — Wed, 05 Mar 2008 20:13:00 +0000

It was shut down.

By: Daniel Miessler

Daniel Miessler — Wed, 05 Mar 2008 20:13:00 +0000

It was shut down.

By: Maxo

Maxo — Wed, 05 Mar 2008 19:24:31 +0000

Another question, what was the order in which you did everything? Where you able to pull data from the computer after it was completely shut down, or while it was in sleep/hibernate? Or did you have to pull it from the PC while it was running and logged in to?

By: Maxo

Maxo — Wed, 05 Mar 2008 19:24:00 +0000

By: Maxo

Maxo — Wed, 05 Mar 2008 14:24:30 +0000

I’m very interested to find out what other information you are able to grab from this. The fact that all you need is a USB key with special software is really shocking. Do you think a person who is only semi-technical could be given these tools and easily trained to pull this information?