Prosecution based on memory forensics

[Werner Koch]

On Thu, 13 Jan 2011 12:23, johanw at vulcan.xs4all.nl said:

> For Windows, TrueCrypt has a free open source solution to this in the
> form of system encryption.

Does not help.  Despite that we talked about hibernation, most users
don't use S4 (Suspend-to-Disk) but the system goes into S3
(Suspend-to-RAM) when you close the lid.  Better systems then proceed to
S4 only when the battery gets too low.

Reading out a powered RAM (S3) might be complicated for the home user
but not for a lab.


Shalom-Salam,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.