Aquiring imges of D...
 
Notifications
Clear all

Aquiring imges of DDR2 after BIOS POST memory test on "modern PC's"

3 Posts
2 Users
0 Likes
810 Views
(@bendd)
Posts: 2
New Member
Topic starter
 

Hello,

Does anyone here have experience with taking a RAM image after performing a full BIOS POST memory test?

Does anyone known whether the entire RAM memory is actually overwritten during this full test, and whether the CPU L1 and L2 cache will also be overwritten?

If so, is it then possible to recover data from RAM in another way?

This question applies to older computers around year 2000 and DDR2 memory only, when the "fast/fast boot" option is disabled in the BIOS.

I have come across a few cases where people claimed that the memory would not be overwritten anyway because the bios memory test was not designed correctly or was designed in a different way.

Thank you

 
Posted : 17/12/2022 6:20 am
(@athulin)
Posts: 1155
Noble Member
 

You are phrasing it a bit oddly: are you asking if RAM contents remains after a full power-down, or is it a more esoteric question involving other power-states that trigger a POST  (only thing I can think of is some form of hibernation, and then you have memory contents stored anyway ...)  Or are you looking for details of how to do a cold-boot attack in practice? 

DDR is dynamic memory: it needs power and it needs constant refreshes (well, generally) to keep memory contents alive.  If power goes ... pfft goes memory contents.  In which case the question of how POST memory testing behaves when the system is powered back on again is largely academic.

In very special circumstances (Google for Cold Boot Attack) it is possible to retain/recover memory, ... but as far as I understand that is something that needs a lab and a very special setup to work. As a normal computer forensic technician who wants to retain memory contents of a running system, you just ensure that there's no power-down. (And you train for how to handle that situation.)

Static and pseudo-static RAM ... well, as you ask about DDR2, those are beasts of a different colour.

 

You might want to explain why you ask, or what you hope to achieve.

(Added: how POST memory test actually behaves is likely to be BIOS or UEFI specific, and not impossibly related to release version. It basically needs to be tested or disassembled in order to say anything for certain.)

 
Posted : 17/12/2022 8:45 pm
(@bendd)
Posts: 2
New Member
Topic starter
 

Posted by: @bendd

"fast/fast boot"

 

I meant "quick boot"

 

 

Posted by: @athulin

You might want to explain why you ask, or what you hope to achieve.

 

I am interested in possible options.

 

 

 
Posted : 18/12/2022 3:55 am
Share: