Initial Question: How to extract computer memory data when computers are frozen. I removed my question from that topic to post here per request.
This article is a how-to tutorial on using a "coldboot" attack to recover encryption keys. It is based on several references linked in that article. One is from Princeton University, the other the Hak5 site. They are all based on a finding at Princeton that the the contents of RAM do not immediately disappear. They can persist for seconds to minutes at room temperature, or longer with freezing, after the power is removed, even removing the RAM modules from the motherboard. The Princeton paper mentions the potential to acquire usable full-system memory images by this method. The first link refers to recovering 8 to 16GB of data from a preceding boot, which could be any data on the 'frozen', or as referred to in the previous question, 'deadlocked', PC.
It appears that it is at least theoretically possible to recover RAM contents from a frozen system with this approach, either by transplanting the RAM to another computer or using a USB tool like described in the first link, and obviously results would vary. But would this be a "go-to" (preferred) method to use at home? Would this be more practical or less practical that other methods like DMA? Would it be expected to have a higher or lower chance of success? Would it be something to try first or only as a last resort, or would that depend on the availability of equipment and software required for a DMA approach? This question is from the perspective of someone who is not intimately familiar with either method.
