Home / ubuntu / Questions / 1293187
In Process
JJrussel
Asked: 2020-11-18 15:44:34 +0800 CST

Is there a possibility for anything to remain in ram from a non-persistent Xubuntu 20.04 live usb?

  • 772

So I've recently discovered that whether torom or not, Xubuntu 20.04 LTS (unlike 18.04) operates completely(?) on ram. If I unplugged the USB as soon as it boots up, I am able to open all applications and they all work normally. This is without toram.

So I was wondering...if I'm using non-persistent Xubuntu 20.04 LTS, does anything (like anything at all) save either temporarily or permenantly on the ram and be there when I end the session (restart the computer)? Is it technically possible? Or is the ram completely wiped by next boot up and it's physically impossible for anything to be there?

boot live-usb xubuntu ram

3 Answers

  1. The toram is used so that during the boot up the entire media is copied into RAM and ran from there allowing you to remove the USB media without crashing the system. As long as your USB media is not persistent, no settings will be saved and every boot to the USB will be like it is new.

    RAM is volatile memory which means that once the power is cut to the RAM, i.e. a system reset or a power off, all contents of RAM are cleared (erased). This is why in power saving modes like sleep will keep low power to the computer so that the RAM keeps the programs loaded into it, but they are not running as processes are stopped in sleep mode. As a hibernation will copy all contents of RAM to the hard drive then power off. Upon reboot after hibernation the contents get copied back to RAM restoring the previous session.

    • 1

  2. RAM from a Non-Persistent USB and Swap

    Another good question.

    A Live, (non-persistent), USB will use any swap partitions that are on the computer, including those on the hard drive.

    You can confirm this by typing free or sudo swapon -s, while booted from a Live USB on a computer with a swap partition, (even if the swap partition is on another USB).

    It is my understanding that the contents of swap can be read using the right tools.

    If you want to hide what you have been doing, it might be best to run sudo swapoff -a before shutting down.

    • 0

  3. From a purely technical perspective, RAM will lose ability to hold data when it is powered off.

    Please note we are talking about exactly 2 things:

    • RAM - which by definition is non-persistant
    • complete loss of power

    From there we need to mention that poweroff and reboot can mean a lot of different things. There are cold and hot reboots, and all kinds of suspending, sleeping and hibernating states.

    If your temporary Live PC wasn't completely unplugged from power source - there CAN BE some remains in memory. But to recover the data would require forensic expertise. Many things will affect what and how much could be salvageable from incorrect or incomplete poweroff. If someone just rebooted (hot reboot usually), then RAM will NOT lose power. But any new OS will erase good chunk of old data simply by overwriting it with it's own data.

    I would be interested why you ask the question, but if we are talking about "non-persistant" live CD experience, and then recovering data from RAM by a 3rd party after you rebooted PC and left with your CD/USB, it is extremely unlikely that any useful data would be recovered... Unless we're talking some cyber squad from movies. But TECHNICALLY... parts of your data could still be there, as RAM's physical (electrical) state of some bits would stay unchanged.

    • 0