0

I saved a text file on the desktop while booted in non-persistent Xubuntu 20.04 LTS live USB created with UNetbootin.

Naturally that file was gone when I restarted the computer and booted back into live Xubuntu.

Given that files are never really %100 deleted and parts of it will be saved in several places, what are my chances of recovering the file (or any part of it) if - hypothetically - I had all the resources needed to do the job?

JJrussel
  • 287
  • 1
  • 4
  • 11
  • 1
    The file was only stored in memory. It'll need a program to scan memory looking for it (however everything you load from then on could potentially overwrite the memory locations where the file was stored, if machine is turned off contents will be lost very quickly unless you're at very low temperatures which extend time somewhat...). ie. you've little chance unless you were prepared for it. – guiverc Nov 12 '20 at 00:53
  • By memory you mean ram? I thought ram was incapable by design of storing anything. – JJrussel Nov 12 '20 at 01:37
  • Yes by memory I meant dRAM (dynamic RAM). On restart the next booted OS will use RAM overwriting whatever was there before hand without regard, programs can `malloc()` that ram & scan to see what was in it (why some *live* systems offer the choice of delaying shutdown by a number of minutes to overwrite RAM so nothing is left behind, Xubuntu doesn't offer that as few want it) On turning the machine off, without refreshes dram will lose it's contents in 3-15 secs (which can be extended by use of liquid nitrogen to cool it...) but again you need to be prepared.. Effectively it's lost. – guiverc Nov 12 '20 at 02:30
  • Could I ask you to have a look at my other question please? Particularly my comments there. I'd love your input. https://askubuntu.com/questions/1291291/how-to-know-whether-xubuntu-is-running-on-ram-or-the-live-usb/1291350?noredirect=1#comment2192900_1291359 – JJrussel Nov 12 '20 at 02:48
  • You have already got input from sudodus and C.S.Cameron, both of whom are highly regarded in that particular area... – guiverc Nov 12 '20 at 02:54
  • I actually haven't, yet. – JJrussel Nov 12 '20 at 02:55
  • Give them time to answer (we're all in different timezones, and don't forget the COW in your final paste! even if you eject the *live* system, IF contents were modified, due COW (ie. copy on write) contents of file will be in RAM & thus survive eject... but that won't apply to everything, system plus what you did all influence what gets 'changed' in session.. – guiverc Nov 12 '20 at 03:05
  • Could you elaborate on "don't forget the COW in your final paste!"? What does that mean exactly? – JJrussel Nov 12 '20 at 03:10
  • If hibernation has been enabled, then the data in RAM will be written to a swapfile or swap partition on the disk. When resuming from hibernation, the data will be written back to RAM. It is difficult to enable hibernation on a live USB and it will not happen accidentally. – C.S.Cameron Nov 12 '20 at 07:33

1 Answers1

0

The file was only stored in memory (dynamic RAM). Yes you may save files and store them on a fs (file-system) but that file-system was created in RAM itself, and not on disk or other more permanent storage.

It'll need a program to scan memory looking for it. On restart the next booted OS will use RAM overwriting whatever was there before hand without regard, programs can malloc() (memory allocate) that ram & scan to see/save what was in it (why some security-based live systems offer the choice of delaying shutdown by a number of minutes to overwrite RAM so nothing is left behind, Xubuntu doesn't offer that as few want it)

On turning the machine off, without refreshes dram will lose it's contents in 3-22 secs (depending on temperature & environment, though that can be extended by use of liquid nitrogen to cool ram chips) but again you need to be prepared..

Effectively it's lost. The file-system it was stored to existed only in memory/ram unless you mounted a non-volatile file-system, or scp or copied it before shutdown.

guiverc
  • 28,623
  • 5
  • 46
  • 74