CMOS Battery
Definition
A small lithium cell (typically CR2032) that keeps the real-time clock and a few firmware settings alive when the system is unplugged. Removing it is one of the classical resets for a forgotten BIOS password.
- Common type
- CR2032 lithium coin cell
- Function
- Powers real-time clock and firmware settings when unplugged
- Forensic relevance
- Removal resets a forgotten BIOS password
- Location
- Motherboard
Common questions
Why would an examiner care about the CMOS battery during a hardware examination?+
If the battery has been removed or is depleted, the system clock resets to a default date on next boot, which can explain anomalous or clearly wrong timestamps in system logs and needs to be accounted for before relying on those timestamps.
Does removing the CMOS battery erase data stored on the hard drive?+
No, it only resets BIOS or UEFI firmware settings and the real-time clock, since the battery has no connection to data stored on the drive itself, which is retained independently of CMOS power.
Related terms
- BIOS / UEFI
- Firmware on a flash chip on the motherboard that runs at power-on, initialises hardware, and hands control to a bootloader. UEFI is...
- Chipset (PCH)
- The motherboard logic that bridges CPU, RAM, PCIe lanes, SATA, USB and the firmware (UEFI/BIOS). On Intel boards the Platform Controller Hub;...
- NAND Flash Wear Leveling
- The SSD controller's policy of spreading writes across physical blocks so no single block wears out first. The side effect for forensics...
- Order of Volatility
- The sequence in which digital evidence should be collected, ranked from most to least transient. Defined in RFC 3227. CPU registers and...
- TRIM
- A command issued by the file system to the flash controller identifying blocks that are no longer in use, so the controller...