MRAM, persistance of memory

[Thomas Shaddack]

On Wed, 9 Jul 2003, Eric Murray wrote:
> I doubt it as well.  DRAM also has power-off memory persistence
> and nearly everyone in security ignores that as well.
>
> But not the spooks :
>
> "The FEI-374i-DRS is a data recovery system that captures and preserved
> digital data, in its original format, directly from the Dynamic Random
> Access Memory (DRAM) of Digital Telephone Answering Machines (DTAMs)
> ..
> The FEI-374i-DRS is an indispensable tool for forensic investigators
> required to evaluate residual audio and tag information retained in
> today's DRAM-based DTAMs."
>
> http://www.nomadics.com/374idrs.htm

The system doesn't seem to be able to recover data from powered-off DRAM.
The specs say it can recover files that were erased. The DRAM-based DTAMs
use the DRAM as a RAM disk. For some reason unknown to us (may be
conspiracy with TLA, but Occam's razor says it's mere negligence/laziness)
the designers don't overwrite the memory region that pertains to an erased
file, only deallocate it, leaving the data there. I suppose the DRAM
refresh circuits are backed up with a small battery to cover brief
blackouts.

It is impossible to get access to the voltage on the DRAM cell capacitors
(at least if the chip is in its case and we can access only its pins). We
can only see if it is in the range for H or L. And after a power-down (or
even a sufficiently long period without a refresh of the given cell) the
cell capacitor loses voltage steadily, reaching the level of L (or maybe
H?) within at most couple seconds.

Seems the device is nothing more than a logic analyzer connected to the
DRAM pins.

This is a nice illustration of the problem with comercial vendors and
closed-architecture devices they peddle. If we'd have access to the
firmware of the DTAMs, writing extensions for storing data in (at least
somehow) encrypted format and their overwriting after deletion won't be a
big problem. Hope the price of embeddable computer "cores" will continue
to fall. (Apropos, whats the current cost of the cheapest cores able to
run stripped-down Linux? Maybe something based on ARM or MIPS
architecture?)