Memory forensic data recovery utilising RAM cooling methods

Forensic investigations of digital devices is generally conducted on a seized device in a secure environment. This usually necessitates powering down the device and taking an image of the hard drive or semi-permanent storage in the case of solid state technology. Guidelines for forensic investigations of computers advise that the computer should be shut down by removing the power supply and thereby maintaining the hard disk in the state it was in whilst running. However, valuable forensic evidence often exists in the volatile memory which is lost when this process is followed. The issues of locked accounts on running computers and encrypted files present particular difficulties for forensic investigators who wish to capture a forensic image of the RAM. This research involves freezing RAM removed from a running computer so that it can later be reinserted into an unlocked computer allowing for a forensic image of the RAM to be captured. Three different methods of cooling the RAM are compared, along with varying delays in RAM reinsertion. The results provide a guideline for forensic investigators on how the issues with locked accounts and encryption may be overcome to record this valuable evidence that is otherwise lost