Cold-Boot Attack
Definition
An attack on full-disk encryption that exploits the fact that DRAM contents fade gradually after power-off. With the chips cooled to roughly -50 degrees Celsius using inverted compressed air, key material remains recoverable for seconds to minutes, long enough to reboot into a minimal OS that dumps RAM and extracts the encryption key.
Related terms
- Anti-Forensics
- Any deliberate technique used to hinder, mislead, or defeat forensic examination. The term was coined in the late 1990s by US incident...
- Steganography
- Concealing one file inside another in a way that hides the existence of the hidden file. LSB image manipulation, JPEG DCT coefficient...
- Timestomping
- Falsification of file system timestamps to mislead a timeline analysis. The Metasploit tool timestomp.exe and the open-source SetMACE are the canonical references....
- USN Journal
- The NTFS Update Sequence Number journal ($UsnJrnl:$J), a per-volume change log that records create, delete, rename, and metadata-change events. Survives long after...
- VeraCrypt Hidden Volume
- A second, encrypted volume nested inside the free space of a primary VeraCrypt volume. Either password unlocks one of the two volumes;...
Explained in
- Anti-Forensic Techniques and Investigator Counter-MethodsAn attack on full-disk encryption that exploits the fact that DRAM contents fade gradually after power-off. With the chips cooled to roughly -50 degrees Celsiu...