Cold Boot Attack
The cold boot attack, introduced by Halderman et al., exploits data remanence in DRAM after power-off (minutes at low temperature) to extract disk-encryption keys from memory.
Purpose
It threatens the physical security of full-disk encryption, showing that software disk encryption offers no complete protection against attackers with physical access.
Mechanism
Cold-reboot the running system (or chill the DRAM with cooling spray), read the memory remnants with a malicious OS, and search for AES master-key structure signatures (e.g., BitLocker key structures) to extract keys and decrypt the disk.
Use cases
- Full-disk encryption security assessment
- Key-in-memory safety
- Physical security threats