Electronic – Freezing DRAM for forensics (coldboot)


I've known about the coldboot trick for a while, but have never really considered the physics behind it. I've read the paper, but it doesn't really cover why it works.

How does physically cooling a stick of RAM to a very low temperature cause the data stored in it to be maintained over long periods of time, even without power?

I know that DRAM ICs are essentially a large array of transistor-capacitor storage cells, but I can't work out why the temperature makes any difference.

It also raises further questions:

  • Are the decay characteristics of the device enough to allow for the "previous" value of a cell to be measured, at normal or lower temperatures?
  • Is this the same phenomenon that causes bit-rot, i.e. random flipped bits in computer memory?
  • Does this apply to other scenarios, such as altering the state of microprocessors, or changing how a transistor switches in a discrete circuit?
  • If extreme cold causes the charge state to decay more slowly, would that imply that heating the RAM would erase any data stored in it?

Best Answer

DRAM, as you said, basically consists of a storage capacitor and a transistor to access the voltage stored on that capacitor. Ideally, the charge stored on that capacitor would never decrease, but there are leakage components that allow the charge to bleed off. If enough charge bleeds off the capacitor, then the data cannot be recovered. In normal operation, this loss of data is avoided by periodically refreshing the charge in the capacitor. This is why it is called Dynamic RAM.

Decreasing the temperature does a few things:

  • It increases the threshold voltages of MOSFETs and the forward voltage drop of diodes.
  • It decreases the leakage component of MOSFETs and diodes
  • It improves the on-state performance of the MOSFETs

Considering that the first two points directly reduce the leakage current seen by the transistors, it should be less of a surprise that the charge stored in a DRAM bit can last long enough for a careful reboot process. Once power is reapplied, the internal DRAM system will maintain the stored values.

These basic premises can be applied to many different circuits, such as microcontrollers or even discrete circuits, as long as there isn't an initialization on start-up. Many microcontrollers, for example, will reset several registers on start-up, whether the previous contents were preserved or not. Large memory arrays are not likely to be initialized, but control registers are much more likely to have a reset on start-up function.

If you increase the temperature of the die hot enough, you can create the opposite effect, of having the charge decay so rapidly that the data is erased before the refresh cycle can maintain the data. However, this should not happen over the specified temperature range. Heating the memory hot enough for the data to decay faster than the refresh cycle could also cause the circuit to slow down to the point where it couldn't maintain the specified memory timings, which would appear as a different error.

This is not related to bit-rot. Bit-rot is either the physical degradation of storage media (CD, magnetic tapes, punch cards) or an event causing the memory to become corrupted, such as an ion impact.