So, if you're looking at vague traces of data on a magnetic platter, you can't tell if that bit that looks like it might have been a '1' was a '1' at the same TIME as the bit that's next to it looks like it might have been a '0'.

However, as far as I know HDD bits aren't in a FIFO queue. It IS possible to see previous states of the data on a disk. Think about it from first principles here. That's because formatting doesn't write over anything (except control tables (eg MFT etc on NTFS)) Tell them you formatted the drive and see if they can recover the data. If you don't believe me, just call a data recovery company.

JavaSucks (unregistered) in reply to Zygo.

After that they just dump the RAM contents and fish out the key at their leisure. The motherboard logic will preserve the contents of RAM nicely while they connect the machine to a power source in their getaway vehicle, then later when they connect a logic analyzer to the DRAM bus.

Mind you, if the attacker is smart, they steal your laptop from you while it's powered on with the keys in memory, and just halt the CPU without cutting power to the machine (how that's done is left as an exercise for the WTF readers -). Better start allocating key memory using a wear-levelling algorithm to select RAM addresses. If the key is stored in a constant address in RAM then there is the possibility of it burning into the chips. Someone who tosses your freshly stolen powered-off laptop RAM into a cooler full of dry ice while they whisk it off to their forensics lab to apply their nefarious technologies to it is not going to be inconvenienced. If power to the device is killed before the zeroing code is executed then the zeroing doesn't get done. Doing the zeroing more often hurts performance and provides no extra security. Yes, but such software does the zeroing once, which is sufficient to prevent attacks based on software. Most serious, professional, high-security cryptography software zeroes out its temporary memory after use. Not-so-Simple Network Management Protocol.

Overriding text in davka software