0

I saved a text file on the desktop while booted in non-persistent Xubuntu 20.04 LTS live USB created with UNetbootin.

Naturally that file was gone when I restarted the computer and booted back into live Xubuntu.

Given that files are never really %100 deleted and parts of it will be saved in several places, what are my chances of recovering the file (or any part of it) if - hypothetically - I had all the resources needed to do the job?

9
  • 1
    The file was only stored in memory. It'll need a program to scan memory looking for it (however everything you load from then on could potentially overwrite the memory locations where the file was stored, if machine is turned off contents will be lost very quickly unless you're at very low temperatures which extend time somewhat...). ie. you've little chance unless you were prepared for it.
    – guiverc
    Nov 12, 2020 at 0:53
  • By memory you mean ram? I thought ram was incapable by design of storing anything.
    – JJrussel
    Nov 12, 2020 at 1:37
  • Yes by memory I meant dRAM (dynamic RAM). On restart the next booted OS will use RAM overwriting whatever was there before hand without regard, programs can malloc() that ram & scan to see what was in it (why some live systems offer the choice of delaying shutdown by a number of minutes to overwrite RAM so nothing is left behind, Xubuntu doesn't offer that as few want it) On turning the machine off, without refreshes dram will lose it's contents in 3-15 secs (which can be extended by use of liquid nitrogen to cool it...) but again you need to be prepared.. Effectively it's lost.
    – guiverc
    Nov 12, 2020 at 2:30
  • Could I ask you to have a look at my other question please? Particularly my comments there. I'd love your input. askubuntu.com/questions/1291291/…
    – JJrussel
    Nov 12, 2020 at 2:48
  • You have already got input from sudodus and C.S.Cameron, both of whom are highly regarded in that particular area...
    – guiverc
    Nov 12, 2020 at 2:54

1 Answer 1

0

The file was only stored in memory (dynamic RAM). Yes you may save files and store them on a fs (file-system) but that file-system was created in RAM itself, and not on disk or other more permanent storage.

It'll need a program to scan memory looking for it. On restart the next booted OS will use RAM overwriting whatever was there before hand without regard, programs can malloc() (memory allocate) that ram & scan to see/save what was in it (why some security-based live systems offer the choice of delaying shutdown by a number of minutes to overwrite RAM so nothing is left behind, Xubuntu doesn't offer that as few want it)

On turning the machine off, without refreshes dram will lose it's contents in 3-22 secs (depending on temperature & environment, though that can be extended by use of liquid nitrogen to cool ram chips) but again you need to be prepared..

Effectively it's lost. The file-system it was stored to existed only in memory/ram unless you mounted a non-volatile file-system, or scp or copied it before shutdown.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .