The data could be expected to be retained by which of the following type of memory

Memory

Memory is one of the fundamental components of a system. There is at least some form of memory in a system. A number of technologies are used for making memory devices. However, in all, the memory devices can be classified into two categories: volatile and nonvolatile memory. Let's quickly review the two classifications and then we'll discuss them in detail in Chapter 7.

RAM and ROM

RAM is volatile memory used to hold instructions and data of currently running programs. It loses integrity after loss of power. RAM memory modules are installed into slots on the computer motherboard.

ROM (Read-Only Memory) is nonvolatile: data stored in ROM maintains integrity after loss of power. A computer Basic Input Output System (BIOS) firmware is stored in ROM. While ROM is “read only,” some types of ROM may be written to via flashing, as we will see shortly in Section “Flash memory.”

RAM and ROM

RAM is volatile memory used to hold instructions and data of currently running programs. It loses integrity after loss of power. RAM memory modules are installed into slots on the computer motherboard. Read-only memory (ROM) is nonvolatile: Data stored in ROM maintains integrity after loss of power. The basic input/output system (BIOS) firmware is stored in ROM. While ROM is “read only,” some types of ROM may be written to via flashing, as we will see shortly in the Flash Memory section.

Note

The volatility of RAM is a subject of ongoing research. Historically, it was believed that DRAM lost integrity after loss of power. The “cold boot” attack has shown that RAM has remanence; that is, it may maintain integrity seconds or even minutes after power loss. This has security ramifications, as encryption keys usually exist in plaintext in RAM; they may be recovered by “cold booting” a computer off a small OS installed on DVD or USB key and then quickly dumping the contents of memory. A video on the implications of cold boot, Lest We Remember: Cold Boot Attacks on Encryption Keys, is available at //citp.princeton.edu/memory/. Remember that the exam sometimes simplifies complex matters. For the exam, simply remember that RAM is volatile (though not as volatile as we once believed).

Appendix 25 Some Evidence Found in Volatile Memory

The evidence recovered from volatile memory acquisition will vary depending on the device being acquired, but depending on the device being acquired will include, but not limited to:

available physical memory;

BIOS information;

clipboard information;

command history;

cron jobs;

current system uptime;

driver information;

hot fixes installed;

installed applications;

interface configurations;

listening ports;

local users;

logged on users;

malicious code that is run from memory rather than disk;

network cards;

network information;

network passwords;

network status;

open DLL files;

open files and registry handles;

open files;

open network connections;

operating system and version;

pagefile location;

passwords and crypto keys;

plaintext versions of encrypted material;

process memory;

process to port mapping;

processes running;

registered organization;

registered owner;

remote users;

routing information;

service information;

shares;

system installation date;

system time;

the memory map;

the VAD tree;

time zone;

total amount of physical memory;

unsaved files;

user IDs and passwords.

Alert!

13.4 The curse of copying—I/O performance matters

Traditional Internet Protocol (IP) stacks adopt the notion of “streaming,” in which a limited amount of data may be buffered but most of the data is sent out right away. If the outgoing link is currently unavailable or overloaded, packets are discarded. End-to-end data loss is usually prevented by end-to-end retransmissions of higher-level protocols. In a DTN the outgoing link may be unavailable over an extended period of time and data has to be stored on nodes. The DTN architecture (Cerf et al., 2007) further requires such storage to be persistent so that stored data survives system restarts.

Commercial Ethernet switches employ the “store-and-forward” paradigm in which frames are received, buffered (usually in RAM), and subsequently forwarded. While this allows switches to do error checking, it also requires enough temporary storage for at least a single frame. While Ethernet frames are limited in size, ADUs (which are transformed into PDUs by the DTN Engine) in a DTN are “possibly long” (Cerf et al., 2007) and normally not limited in size. When talking about the BP, PDUs have, in fact, limited size of 1.8 × 1019 bytes (because a self-delimiting numeric value (SDNV) can only hold 264 − 1 values).

So, a DTN Engine has to persistently store PDUs of significant size. While the performance of IP stacks is usually limited by the processing capabilities, DTN Engines will likely be limited by the storage bandwidth. Since PDUs have to be stored and retrieved during forwarding, the attainable throughput cannot exceed 50% of the storage bandwidth. Since persistent storage usually involves a hard disk drive (HDD) or flash memory, the storage bandwidth is significantly lower than RAM used in the switches. This makes it clear that DTNs are not a good match for streaming applications (many small ADUs) because the overhead per ADU is comparably high. Furthermore, supporting ADUs of arbitrary size causes certain handling problems, which will be discussed in this section.

5.5.4 Area and Delay

Flip-flops, SRAMs, and DRAMs are all volatile memories, but each has different area and delay characteristics. Table 5.6 shows a comparison of these three types of volatile memory. The data bit stored in a flip-flop is available immediately at its output. But flip-flops take at least 20 transistors to build. Generally, the more transistors a device has, the more area, power, and cost it requires. DRAM latency is longer than that of SRAM because its bitline is not actively driven by a transistor. DRAM must wait for charge to move (relatively) slowly from the capacitor to the bitline. DRAM also fundamentally has lower throughput than SRAM, because it must refresh data periodically and after a read. DRAM technologies such as synchronous DRAM (SDRAM) and double data rate (DDR) SDRAM have been developed to overcome this problem. SDRAM uses a clock to pipeline memory accesses. DDR SDRAM, sometimes called simply DDR, uses both the rising and falling edges of the clock to access data, thus doubling the throughput for a given clock speed. DDR was first standardized in 2000 and ran at 100 to 200 MHz. Later standards, DDR2, DDR3, and DDR4, increased the clock speeds, with speeds in 2021 being over 3 GHz.

Table 5.6. Memory comparison

Memory latency and throughput also depend on memory size; larger memories tend to be slower than smaller ones if all else is the same. The best memory type for a particular design depends on the speed, cost, and power constraints.

Pagefile.sys and Hiberfil.sys

Like their UNIX/Linux counterparts, Windows systems often have a need to swap data out of volatile memory to a location on the disk. However, whereas most nix systems have a whole partition (small as it may sometimes be) dedicated to this swap space, Windows systems tend to use one single file, pagefile.sys. Pagefile.sys (or simply, the page file) is created when Windows is installed and is generally 1 to 1.5 times the size of the installed system RAM on XP systems. The settings for the size of the page file, as well as whether the file is cleared at shutdown or disabled entirely can be found in the SYSTEM\<ControlSet###>\Control\Session Manager\Memory Management registry subkey.

The page file has intrigued examiners for years because theoretically it could contain any data that was held in memory for long after a system was powered down; these data could include unpacked executables, unencrypted passwords, encryption and communications keys, live chat messages, and more. However, the challenge has always been how to extract usable data from the mass of digital detritus often found within the pagefile.sys. One strategy is to use a tool like strings.exe (//technet.microsoft.com/en-us/sysinternals/bb897439.aspx) or BinText (www.foundstone.com/us/resources/proddesc/bintext.htm)to attempt to pull out user-readable text from the page file. This can be effective, but even the elimination of all the “machine code” characters can leave the investigator looking through line after line of “48dfhs9bn” and “%__<>” strings, unable to discern the meaning of the seemingly random data. Another strategy is to look for recognizable data structures. As just a few examples, looking for executable headers (\x4d\x5A\x90), searching for URL prefixes (e.g., // or www.), or locating the text PRIVMSG (which precedes each message sent in many IRC chat clients) could pay dividends, depending on the type of investigation. Further, understanding the geographic relationship between data can be helpful. Consider the e-mail login prompt in Figure 5.47.

To the user the password appears masked by dots; however, the computer sees the underlying data and the password to be used is held in RAM. If a search of the pagefile.sys revealed the user's e-mail address, it is not out of the realm of possibility that the user's password could be in close proximity and easily identified, particularly if it is a user-friendly word or phrase.

The hiberfil.sys is similar to the page file, but rather than being used as active swap space, the hiberfil.sys is a repository for the contents of RAM (in a compressed format) when a system is told to hibernate (such as when the lid of a laptop is closed).

Vista handles hibernation a bit differently than previous Windows versions in that it has three related modes: sleep, hibernation, and hybrid sleep-hibernation. In sleep mode, the system continues to supply minimal power to RAM maintaining the contents and not requiring the system to use the hiberfil.sys. Hibernation, on the other hand, causes the contents of RAM to be saved to the hiberfil.sys for restoration when the system “wakes up.” The hybrid sleep-hibernation mode takes advantage of both techniques, continuing to supply low-level power to RAM and saving the contents to the hiberfil.sys for redundancy. The SandMan Project is specifically aimed at assisting investigators in performing forensic analysis of Windows hibernation files (//sandman.msuiche.net/).

Many examiners have also begun to encounter ReadyBoost used in conjunction with Vista systems. ReadyBoost uses up to 4GB of flash memory (usually in the form of a USB device or flash card) as a memory cache (virtual memory); specifically, Vista uses the flash memory to store data important for the function of the memory manager. An advanced version of ReadyBoost is also listed as a feature for Windows 7, removing the 4GB size restriction for utilized flash memory. Although the user can enjoy the speed gains from ReadyBoost, its use has little impact for the forensic examiner. A file called Readyboost.sfcache is created on the flash media used for ReadyBoost, but the file is (unfortunately for the examiner) 128-bit AES encrypted and represents nothing other than that the device was used for that purpose.

17.1 Introduction

It is now well established from a variety of studies that memories is generally classified into two fundamental categorizes: volatile memory and nonvolatile memory [2,3,17]. In general, volatile memory needs power to maintain the stored information. In contrast, the stored information is retained in nonvolatile memory when the power supply is turned off. Fig. 17.1 shows a taxonomy of memories. Volatile memory can be categorized into static random-access memory (SRAM) and dynamic random-access memory (DRAM) while nonvolatile memory may be divided into several groups (see Fig. 17.1). In numerous electronic devices (portable devices, sensors in wireless sensor nodes, embedded systems etc.), a matter of considerable concern is battery life [16]. A great deal of previous research into memory has focused on how to enlarge the operational life time of such electronic devices [20,38,42].

In recent years, there has been an increasing amount of literature on memristor, a potential candidate for emerging memory technologies [9,10,17,21,31]. Chua suggested that resistance switching memories were memristors [5]. Compared to the existing memory devices, the power consumption of a memristor was smaller [9,10]. Taherinejad et al. explored the possible storage of multi-bit data in a single memristor [30]. A memristor-based memory cell had less noise margins and stored non-binary data [39]. Discovering applications of the memristor for developing emerging memories is still an attractive research trend [7,18,25,34,35].

The development of the 4.0 era has received considerable critical attention. In recent years, there has been an increasing interest in portable devices, smart phones, smart homes, and smart cities. As a result, the demand for memories has increased significantly [6,11,26,29]. Embedded memory, emerging memory technologies as well as in-memory computing have received considerable attention recently. Resistive RAM (RRAM, or ReRAM) is a potential candidate for emerging nonvolatile memory technologies [1,14,24,37,40]. Compared with current RAM or read-only memory (ROM), resistive RAM is suitable for faster computing power and higher intensity [4,13,33,36,41].

From the view point of manufacturing, it is simple to see that printed electronics is an emerging fabrication method because of its lithography-free or vacuum-free processing [24]. Moreover, screen and ink-jet printing technologies have been investigated and used in electronic manufacturing [1,14]. It is noted that ink-jet method has been applied to fabricate electronic devices because such a method provides advanced features such as having lowest price and being easy to use [1,14,24]. Recently, there has been renewed interest in electronics with organic materials [19,27]. The key aspects of advancements can be easily listed as follows: low temperature process, low-cost, and mechanical flexibility [4,13,15,23,33]. Therefore, organic RRAM is promising for novel storage and/or processing information technologies. Organic RRAM promotes emerging applications of flexible electronics. Synthesis of Au nanoparticle and its application to fabricate organic RRAM device were reported in [12]. Dao introduced a high-performance organic resistive device to illustrate the application of the Au nanoparticle for RRAM array [8].

This chapter summarizes the implementation of organic RRAM with ink-jet printer. Design process is presented in Section 17.2 while fabrication process is reported in Section 17.3. Section 17.4 introduced a real application of the fabricated Organic RRAM for RFID.