About a month ago, I asked for comments about recovering data from semiconductor memory after power had been removed. After much procrastinating, I've finally finished the summary of what people sent me. Many thanks to everyone who responded, in particular to Bob Hale for answering many questions about the possibility of recovering data from DRAM's. If anyone has any further comments to add to this (I'm particularly interested in actual figures for data retention in DRAM cells, although I've been told this is burn-before-reading proprietary information), you can send it to me at the above address. Peter. -- Summary: Data retention in semiconductor memory -- Contrary to conventional wisdom, "volatile" semiconductor memory does not entirely lose its contents when power is removed. Both static (SRAM) and dynamic (DRAM) memory retain some information on the data stored in it while power was still applied. SRAM is particularly susceptible to this problem, as storing the same data in it over a long period of time has the effect of altering the preferred power-up state to the state which was stored when power was removed. Older SRAM chips could often "remember" the previously held state for several days. In fact, it is possible to manufacture SRAM's which always have a certain state on power-up, but which can be overwritten later on - a kind of "writeable ROM". DRAM can also "remember" the last stored state, but in a slightly different way. It isn't so much that the charge (in the sense of a voltage appearing across a capacitance) is retained by the RAM cells, but that the thin oxide which forms the storage capacitor dielectric is highly stressed by the applied field, or is not stressed by the field, so that the properties of the oxide change slightly depending on the state of the data. One thing that can cause a threshold shift in the RAM cells is ionic contamination of the cell(s) of interest, although such contamination is rarer now than it used to be, because robotic handling of the materials and the purity of chemicals is greatly improved. However, even a perfect oxide is subject to having its properties changed by an applied field. When it comes to contaminants, sodium is the most common offender - it is found virtually everywhere, and is a fairly small (and therefore mobile) atom with a positive charge. In the presence of an electric field, it migrates towards the negative pole with a velocity which depends on temperature, concentration of the sodium, the oxide quality, and the other impurities in the oxide such as dopants from the processing. If the electric field is zero and, given enough time, the sodium contamination tends to spread itself around evenly. Other factors which affect the rate of change are temperature, the field strength of the stored charge, the quality of the oxide, and the concentration of dopants and other impurities which have already been mentioned above. The stress on the cell a cumulative effect, much like charging an RC circuit. If the data is applied for only a few milliseconds then there is very little "learning" of the cell, but if it is applied for hours then the cell will acquire a strong (relatively speaking) change in its threshold. The effects of the stress on the RAM cells can be measured using the built-in self test capabilities of the cells, which provide the the ability to impress a weak voltage on the storage cell in order to measure its margin. Cells will show different margins depending on how much oxide stress has been present. Many DRAM's have undocumented test modes which allow some normal I/O pin to become the power supply for the RAM core when the special mode is active. One way to activate the special test mode might be to underdrive a pin and turn on its protection diodes(s), which will be recognized internally and will change a multiplexer so that the core is powered by some pin which is normally a digital I/O pin. Another way, if the DRAM has suitable clocks, is to recognise an invalid combination of clocks (such as CAS before RAS, if the DRAM doesn't use that mode for higher speed operation) to enable the test mode. Great care must be taken to ensure that the test mode isn't inadvertently entered so that the memory system appears to be malfunctioning (for example in the first case if the system has substantial undershoot at the wrong time, the test mode could be activated). This problem can be avoided by designing the test mode signals such that a certain set of states which would not occur in a normally-functioning system has to be traversed to activate the mode. Manufacturers won't admit to such capabilities in their products because they don't want their customers using them and potentially rejecting devices which comply with their spec sheets, but have little margin beyond that. One way to speed up the annihilation of stored bits in semiconductor memory is to heat it. Both DRAM's and SRAM's will lose their contents a lot more quickly at Tjunction = 140C than they will at room temperature. Several hours at that temperature with no power applied will clear their contents sufficiently to make recovery difficult. Conversely, to extend the life of stored bits with the power removed, drop the temperature below -60C (some people even claim that you can permanently "imprint" an SRAM with its stored bits by rapidly cooling it below liquid nitrogen's boiling point). In any case it should lead to weeks, instead of hours or days, of data "retention". Simply repeatedly overwriting the data held in DRAM with new data isn't nearly as effective as it is for magnetic media. The new data will begin stressing or relaxing the oxide as soon as it is written, and the oxide will immediately begin to take a "set" which will either reinforce the previous "set" or will weaken it. The greater the amount of time that new data has existed in the cell, the more the old stress is "diluted", and the less reliable the information extraction will be. Generally, the rates of change due to stress and relaxation are in the same order of magnitude. Thus, a few microseconds of storing the opposite data to the currently stored value will have little effect on the oxide. Ideally, the oxide should be exposed to as much stress at the highest feasible temperature and for as long as possible to get the greatest "erasure" of the data. Unfortunately if carried too far this has a rather detrimental effect on the life expectancy of the RAM. Therefore the goal to aim for when sanitising memory is to store the data for as long as possible rather than trying to change it as often as possible. Conversely, storing the data for as short a time as possible will reduce the chances of it being "remembered" by the cell. Based on tests on DRAM cells, a storage time of one second causes such a small change in threshold that it probably isn't detectable. On the other hand, one minute probably is detectable, and 10 minutes is certainly detectable. The most practical solution to the problem of DRAM data retention is therefore to constantly flip the bits in memory to ensure that a memory cell never holds a charge long enough for it to be "remembered". While not practical for general use, it is possible to do this for small amounts of data such as encryption keys.